Skip to main content
ToolKB Logo
Home/Legal

Security Architecture: Client-Side and API Controls

Last updated: October 20, 2026•Effective date: October 20, 2026

1. Core Architecture: Client-Side Sandbox

The most effective way to protect sensitive personal photographs, government exam credentials, and client invoices is to never transmit them across the network in the first place.

ToolKB eliminates server file exposure risks by executing all media processing locally inside your web browser:

  • Zero Remote File Storage: We do not operate file upload servers, cloud object storage buckets (such as AWS S3 or Google Cloud Storage), or databases for your files.
  • Local Memory Execution: Image compression, format conversion, PDF merging, video transcoding, and invoice creation execute within the browser isolated memory sandbox via HTML5 Canvas, Web Workers, and WebAssembly (WASM).
  • Immediate Memory Disposal: Once you close your browser tab or complete your download, temporary in-memory blob objects are released by browser garbage collection.

2. Verified Input Validation & Processing Controls

To prevent malicious file payloads, memory exhaustion, or browser instability, ToolKB applies multi-layered client-side validation:

  • Magic Bytes Validation: In addition to checking file extensions, code inspects true binary magic bytes (for example, verifying 0xFF 0xD8 for JPEG or 0x89 0x50 0x4E 0x47 for PNG) before initiating parsing.
  • File Size Ceilings: Single-image uploads are constrained by file size thresholds to prevent pixel bombs and memory allocation crashes on mobile devices.
  • PDF & Video Resource Boundaries: PDF manipulation via pdf-lib and video compression via WebAssembly enforce execution time limits and buffer boundaries to safeguard user device resources.

3. Server-Side API Security & Authorization

While files are processed client-side, account management, subscription states, and daily usage quotas rely on protected serverless API endpoints:

  • Authentication Verification (Clerk): All protected account API routes cryptographically verify Clerk session JWT tokens on the server before retrieving or modifying user records.
  • Database Isolation (Supabase Postgres): The database enforces Row-Level Security (RLS) policies. Backend Next.js API endpoints communicate using isolated service-role keys from secure server environments; no database credentials or service keys are exposed to the browser client.
  • Payment Webhook Verification: Every payment event from Razorpay (such as subscription activation, charge confirmation, or cancellation) is validated using HMAC SHA-256 signatures with constant-time equality comparisons to prevent timing attacks or forged webhook events.
  • Server-Side Entitlement Checks: Premium Pro and Business capabilities (higher daily download quotas, large batch limits, and business tools) are validated authoritatively on the backend, preventing client-side bypasses.

4. HTTP Transport Security & Browser Defenses

ToolKB enforces modern web security headers across all edge responses:

  • Content Security Policy (CSP): An explicit CSP restricts script execution strictly to verified origins (self, Clerk, Razorpay, and Google Analytics), blocking unauthorized inline scripts and data exfiltration.
  • Strict Transport Security (HSTS): Automated HTTP-to-HTTPS redirection with modern TLS encryption across all connections.
  • Frame and Type Safeguards: Configured with X-Content-Type-Options: nosniff to prevent MIME sniffing, X-Frame-Options: DENY to prevent clickjacking, and strict Referrer-Policy.

5. How to Independently Verify Our Privacy Claims

You do not need to take our word for it. You can independently verify that your files remain private using your browser built-in developer tools:

  1. Open Developer Tools: In Google Chrome, Mozilla Firefox, Microsoft Edge, or Safari, press F12 (or Ctrl+Shift+I on Windows / Cmd+Option+I on macOS).
  2. Switch to the Network Tab: Click on the Network tab in the developer tools panel and check the "Fetch/XHR" filter.
  3. Process a File: Select an image, compress it, convert it, or generate an invoice on ToolKB.
  4. Inspect Network Activity: You will observe that no HTTP POST or PUT requests containing your file payload, image data, or document contents are sent to ToolKB or any remote server.
  5. Offline Verification: You can load a tool page, disconnect your Wi-Fi or enable Airplane Mode, and continue resizing, compressing, or formatting images. The tools function without an active internet connection once loaded.

6. Responsible Vulnerability Disclosure

We welcome collaboration with cybersecurity researchers, ethical developers, and users to keep ToolKB safe. If you discover a potential vulnerability, we request that you disclose it to us responsibly before public dissemination.

Reporting Guidelines:

  • Email your vulnerability report directly to support@toolkb.in.
  • Include reproducible steps, a technical proof of concept (PoC), and browser environment details.
  • Do not perform denial-of-service (DoS) attacks, exploit bugs to damage infrastructure, or compromise other users systems.
  • Allow reasonable time for us to investigate and apply a remediation before public disclosure.

7. RFC 9116 Machine-Readable Security Contact

In accordance with internet standard RFC 9116, our machine-readable security contact information is published at:

https://toolkb.in/.well-known/security.txt