Your workbooks never leave your device

DraftReview is built so that we cannot see your files even if we wanted to. This page explains what runs in your browser, what reaches our servers, and how you can verify it.

What happens when you check a file

1. Your browser downloads the DraftReview page and the analysis engine (JavaScript), served from Cloudflare’s network.
2. When you choose a workbook, the browser reads it into memory on your device.
3. The engine runs in a sandboxed Web Worker, parses the file as data and produces the findings.
4. The results are shown on the page. Exports are generated locally and saved straight to your computer.

At no point is the workbook, any cell value or any finding sent over the network.

How to verify it yourself

• Open your browser’s developer tools, go to the Network tab and run a check: no request carries your file.
• Load a tool page, disconnect from the internet, then run a check — it still works.

What our servers do store

Only what is needed to run accounts and billing:

• Your email address, if you create an account, and the time you last signed in.
• Your plan status and billing identifiers received from Creem, our payment provider. We never see card details.
• Messages you send through the contact form.

We use Cloudflare Web Analytics, which is cookieless and does not track individuals. See the privacy policy.

File handling safeguards

• VBA macros, external data connections and Power Query are never executed.
• Files are checked for zip-bomb style expansion and oversized sheets before they are parsed.
• Password-protected and legacy binary (.xls) workbooks are rejected rather than partially read.
• CSV exports neutralise cells that start with =, +, - or @ to prevent formula injection.

Infrastructure

The site and API run on Cloudflare Workers with data stored in Cloudflare D1. Sign-in uses single-use email links that expire after 15 minutes; only a hash of each link is stored. Sessions are signed, HttpOnly cookies.

Teams with formal reviews

If your security team needs a questionnaire answered, a DPA or a private deployment, contact us.