Security Policies
GXA Toolbox uses layered browser, application, account, and hosting controls appropriate to its current architecture. This page describes implemented practices and important user responsibilities without claiming a formal security certification.
Browser-local processing where applicable
Many file tools process selected content in browser memory using browser APIs, JavaScript, WebAssembly, or a locally loaded model. When a workflow is browser-local, the tool can operate without intentionally sending the file contents to the account history service.
Not every browser supports every capability, and some tools load code, models, language data, or other components from the site or a third-party CDN. Users should review the disclosure shown by the selected tool.
Production transport and hosting
The production website is served over HTTPS. Netlify hosts the generated static site and account functions, and the deployment sends security headers that restrict framing, MIME sniffing, object embedding, and form destinations.
HTTPS protects data in transit between a compatible browser and the production host. It does not eliminate risks on a compromised device, unsafe browser extension, malicious file, or third-party network outside GXA Toolbox control.
Accounts, passwords, and sessions
Account passwords are validated and stored as bcrypt password hashes rather than intentional plaintext password records. Authentication requests are same-origin checked, request sizes are limited, and account responses are marked no-store.
The production session is represented by a signed cookie configured as HttpOnly, Secure, SameSite=Lax, with a seven-day maximum age. Session signatures use a deployment secret that is not embedded in public browser code.
Users remain responsible for choosing a unique password, protecting access to their email and device, and signing out on shared devices.
Files and processing history
The account history service records processing metadata for signed-in users, such as tool name, original and output filenames, file size, status, timing, and limited tool metadata. Its current schema does not store uploaded file contents.
Files may still remain in browser memory, object URLs, downloads, temporary operating-system locations, or browser-managed storage during a session. Close sensitive workspaces, remove downloads when no longer needed, and clear site data on shared devices.
Third-party components and supply chain
The application uses established browser libraries, fonts, hosting services, and content-delivery networks. Some heavy tool engines and model files are self-hosted; other libraries or data files are loaded from providers such as Google Fonts, unpkg, cdnjs, and jsDelivr.
Dependencies are limited and pinned where practical, but no software supply chain is risk-free. Availability, browser policy, and upstream changes can affect a tool.
Security limitations
GXA Toolbox does not claim ISO, SOC 2, PCI DSS, HIPAA, penetration-testing, or bug-bounty certification. No online service can guarantee absolute security.
Do not use the service to process content when a legal, contractual, or organizational policy requires a separately approved environment. Keep backups of important originals and inspect downloaded results before relying on them.
Responsible security reporting
Report a suspected vulnerability through Contact Support with a clear description, affected route, reproduction steps, and potential impact. Do not include live passwords, private files, access tokens, or personal data in the report.
Do not disrupt the service, access another person's account, exfiltrate data, or perform destructive testing. GXA Technologies may request additional information needed to reproduce and address a report.
Report a security issue
Send a responsible report through Contact Support without including secrets or private files.