Safety & Privacy

Client-side by design

• Browser-local EDI processing: Supported EDI file contents are parsed in your browser; the application does not intentionally transmit them to or store them on the application server as part of that processing.
• Zero retention: Close or refresh the page and your data disappears from memory.

Analytics and acquisition attribution

GA4 is used for bounded behavioral and session-level analytics. Separately, a first-party database row preserves acquisition context through signup, checkout, and subscription milestones.

That attribution row is not a behavioral event warehouse. It does not store EDI content, filenames, transaction values, patient/member/provider data, transaction type, or output format. Account, quota, analytics, attribution, and billing requests are separate from browser-local EDI processing.

HIPAA considerations (plain English)

• Browser-local processing reduces the need to transmit PHI to the application server, but Business Associate Agreement requirements depend on the actual service relationship, data flow, contracts, and applicable obligations.
• We encourage you to verify outputs against payer documentation and your compliance policies.
• Optional features like de-identification (mask IDs/names) run locally as well.

Risks with server-processed tools

• Uploads may create a disclosure of PHI to the vendor; you may need a BAA and diligence on data handling, storage, and deletion.
• “Auto-delete after upload” still transmits PHI to third-party infrastructure.
• Some sites log metadata that can include filenames, sizes, or IPs associated with PHI workflows.

How we harden the app

• Enforced Content Security Policy restricts scripts and styles to approved sources and per-response nonces; no third-party iframes.
• HTTPS-only hosting recommended (HSTS if you control your domain).
• Open UI about processing: the converter explains that supported EDI file contents are processed locally in the browser, reducing application-server transmission exposure.