Security Architecture
WorkLens is built on a zero-trust, zero-server architecture. Your files never leave your browser.
Core Principle
Zero data leaves your machine. Zero server. Zero upload. Zero exceptions.
8 Security Layers
Blocked External Scripts
Only code from WorkLens is allowed to run. Third-party scripts, tracking pixels, and injected code are blocked by Content Security Policy.
Tab Isolation
Your browser tab is fully isolated using COEP and COOP headers. Other tabs, websites, and extensions cannot access your file data.
Network Disabled During Scan
Once the detection engine starts, all network access is turned off. Your data physically cannot be transmitted — even if someone tried.
Secure Memory Wipe
When you close a scan, your file is overwritten four times (zeros, ones, random, zeros) before being released from memory. No trace remains.
Sandboxed Engine
The detection engine runs inside a WebAssembly sandbox — completely separated from the rest of the page, your filesystem, and the internet.
Cross-Site Request Protection
All API endpoints verify request origin to prevent cross-site attacks. Rate limiting blocks brute-force attempts (5 per minute per IP, 3 per email).
Signed Audit Trail
Every scan produces a digital signature that proves the receipt was generated by WorkLens and has not been tampered with. Verify at theworklens.com/verify.
Worker Integrity Verification
Critical worker files are verified against SHA-256 hashes before execution. If a file has been tampered with, it will not run.
Browser Leak Prevention
Spell checking and automatic translation are disabled on all scan pages. This prevents your browser from silently sending scanned text to Google, Microsoft, or other cloud spell-check and translation services.
How AI Detection Works
Pattern matching runs immediately when you drop a file. It catches emails, phone numbers, credit cards, tax IDs, and 20+ structured types.
A 175MB AI model downloads once and is cached in your browser. On future visits, it loads instantly from cache.
After the first visit, everything runs from cache. Disconnect your internet — scanning still works.
Even if the AI model fails to load, pattern matching catches structured PII like emails, phone numbers, and ID numbers.
Verify It Yourself
Open Chrome DevTools → Network tab → scan a file. You will see zero outbound requests containing file data. Open the Console and type crossOriginIsolated — it returns true, confirming tab isolation. Disconnect your internet and scan again — everything still works.
Report security issues to security@theworklens.com