How local processing works

A factual description of FastMinify's browser-local architecture: what runs where, what you can check yourself, and what an organizational locality guarantee would cover.

Zero outbound requests, demonstrably

FastMinify's developer tools process what you paste or upload entirely inside your browser. A tool run makes no outbound request at all, which you can check with the network panel steps on this page. Uploads to FastMinify servers are only one part of that.

  • Every tool run is orchestrated by a single client pipeline that invokes pure engines shipped with the page.
  • Your input and the engine output stay on your device during processing. They are not sent to FastMinify servers as part of a run.
  • The Content-Security-Policy connect-src allowlist is maintained as a ratchet in the repository: each admitted origin carries a reason and a classification in code.
  • Each tool run makes no outbound request of any kind. You can check this claim yourself in the network panel.

What you can inspect

You do not need to trust marketing copy. These checks use tools already in your browser.

Network panel during a tool run

  1. Open any tool page, then open Developer Tools → Network.
  2. Filter to Fetch/XHR (or All) and clear existing entries.
  3. Paste sample input and run the tool.
  4. While the tool processes your input, the network panel shows no outbound request at all. Page assets load from this site and engines run locally.

Published allowlist

The connect-src allowlist is declared in src/lib/csp-allowlist.ts. Each entry says why it exists and is classified never-during-a-run, which means processing what you pasted cannot reach it. You can compare the live Content-Security-Policy response header with that registry.

Consent-gated surfaces (outside a run)

After you make a cookie choice, the site may load measurement and error-reporting scripts (Google Tag Manager with GA4, Microsoft Clarity, Sentry). They start only after your consent is recorded, are classified never-during-a-run and never process tool input. The contact form may call Cloudflare Turnstile, which has nothing to do with running tools.

What a locality guarantee would cover

For teams evaluating FastMinify for policy-constrained work, an organizational locality guarantee would turn the facts above into an auditable commitment:

  • Input and output remain on the device during tool processing.
  • No transmission of tool payloads to FastMinify or third-party APIs as part of processing.
  • The CSP perimeter and allowlist registry remain inspectable and version-controlled with the product.
  • Deployed inside a customer's network perimeter, the tools would run the same browser-local processing model. Processing would not move to a hosted API.

A guarantee would not replace your own security review of consent-gated telemetry, contact-form anti-abuse, or which pages your users open.

Evaluation contact

If you are evaluating FastMinify for an organization and need to discuss architecture, evidence requirements, or deployment fit, use the contact page.

Go to contact