Security & privacy
Warqa is secure by design, not by promise: servers can’t leak files they never receive.
Where are files processed?
Only inside your browser. When you pick a file it is read into the page’s memory and processed by libraries running on your device (pdf-lib and pdf.js); the result is then downloaded directly. No request ever sends file content over the internet.
How can I verify this?
Open developer tools (F12), go to the Network tab and process any file: you’ll see no upload. You can even disconnect from the internet after the page loads — the tools keep working.
Third-party requests
The core tools contact no third party; every library is hosted on the same domain. The only exception is OCR, which downloads its language model on first use — a static file that carries none of your data, and which can be self-hosted for air-gapped environments.
Security headers
A Content-Security-Policy blocks scripts from outside the domain and form submissions, alongside X-Frame-Options, Referrer-Policy and Permissions-Policy.
Analytics
No cookies and no ad trackers. If measurement is enabled, it is an anonymous counter of tool usage sent only to our own domain — never file names or content.
For organizations
Warqa can be hosted on your intranet as static files with Docker or any web server — no database and no processing server — which makes security review and keep-data-on-premises requirements straightforward.
Frequently asked questions
Do you keep copies of my files?
No — your files never reach us in the first place.