How local processing works

A factual description of FastMinify's browser-local architecture — what runs where, what you can verify yourself, and what an organizational locality guarantee would cover.

Zero outbound requests, demonstrably

FastMinify's developer tools process what you paste or upload entirely inside your browser. A tool run reaches zero outbound requests — demonstrably, via the network-panel checks below — not merely zero payload uploads to FastMinify servers.

  • Every tool run is orchestrated by a single client pipeline that invokes pure engines shipped with the page.
  • Your input and the engine output stay on the device during processing — they are not transmitted to FastMinify servers as part of a run.
  • The Content-Security-Policy connect-src allowlist is maintained as a ratchet in the repository: each admitted origin carries a reason and a classification in code.
  • Each tool run produces zero outbound requests of any kind — the same claim you can verify yourself in the network panel.

What you can inspect

You do not need to trust marketing copy. The checks below use tools already in your browser.

Network panel during a tool run

  1. Open any tool page, then open Developer Tools → Network.
  2. Filter to Fetch/XHR (or All) and clear existing entries.
  3. Paste sample input and run the tool.
  4. During processing, the network panel shows zero outbound requests — not merely zero payload uploads to third parties. Page assets load from this site; engines run locally.

Published allowlist

The connect-src allowlist is declared in src/lib/csp-allowlist.ts. Each entry is annotated with why it exists and classified as never-during-a-run — meaning it is not reachable as a side effect of processing what you pasted. You can compare the live Content-Security-Policy response header to that registry.

Consent-gated surfaces (outside a run)

After you make a cookie choice, the site may load measurement and error-reporting scripts (Google Tag Manager / GA4, Microsoft Clarity, Sentry). These are initialised only after consent is recorded, are classified never-during-a-run, and do not process tool payloads. The contact form may call Cloudflare Turnstile — unrelated to tool execution.

What a locality guarantee would cover

An organizational locality guarantee — for teams evaluating FastMinify for policy-constrained work — would extend the same facts above into an auditable commitment:

  • Input and output remain on the device during tool processing.
  • No transmission of tool payloads to FastMinify or third-party APIs as part of processing.
  • The CSP perimeter and allowlist registry remain inspectable and version-controlled with the product.
  • Deployment inside the customer's network perimeter would run the same browser-local processing model — the processing boundary does not move to a hosted API.

A guarantee would not replace your own security review of consent-gated telemetry, contact-form anti-abuse, or which pages your users open.

Evaluation contact

If you are evaluating FastMinify for an organization and need to discuss architecture, evidence requirements, or deployment fit, use the contact page.

Go to contact