SECURITY & PRIVACY

How the Word editor handles your documents

These statements describe the current implementation in this application. They are intentionally limited to controls that exist in the code today and should not be read as a certification, compliance claim or guarantee.

Editing is browser-based

The current Word editor opens local files through browser File APIs and performs the primary DOCX import, editing and DOCX/HTML export workflow in the browser.

  • The editor does not require an account to create or edit a document.
  • The current editor code does not intentionally upload document contents to an application document-storage server as part of the normal editing workflow.

Autosave and version history are local

The current storage adapter saves drafts and rolling version-history data in browser localStorage on the device where you are editing.

  • Local data can remain in that browser until it is overwritten, cleared by the application, or removed through browser/site-data controls.
  • Local browser storage is not the same as an encrypted cloud backup and should not be treated as one.

Imported HTML is sanitized

Before imported HTML is placed into the editor, the import path removes active or potentially unsafe elements and attributes.

  • Scripts, iframes, forms, embedded objects, metadata and similar active elements are removed.
  • Inline event handlers and javascript: links are removed.
  • External image sources are removed from imported HTML unless they use browser-local data or blob URLs.

File-size and compatibility limits

The current flagship import path rejects files larger than 20 MB. Complex DOCX features can be simplified because browser conversion does not reproduce every Microsoft Word feature.

  • Do not rely on the browser editor as the only copy of an important source document. Keep your original file until you have checked the downloaded result.

Claims we are not making

The current product does not claim ISO certification, SOC 2 certification, HIPAA compliance, a guaranteed server-side deletion period, end-to-end encryption, or perfect DOCX fidelity unless those controls are implemented and independently supportable in the future.