CleanDesk's security model isn't a promise — it's the architecture. The compliance engines run inside your browser, so your register, transaction and customer data never reach our servers. This page lays out exactly what that means, what we hold, and how you can verify every claim yourself.
Every check — DORA register validation, AML screening and monitoring, market-abuse surveillance, CRA scope and SBOM/KEV — executes as JavaScript in your browser, against rule sets and list snapshots bundled with the site. Your file is read locally, processed locally, and stays local. There is no upload endpoint for analysis data.
Verify it yourself in two minutes: open your browser's developer tools (Network tab), load a register or transaction file into any CleanDesk tool and run the check. You'll see the page's static assets load — and no request carrying your data. The strongest data security is data we never hold.
| Data | Where it lives | Who can see it |
|---|---|---|
| Registers, transaction tapes, KYC & customer data, SBOMs | Your browser only (memory + this browser's local storage, if you choose to save) | Only you — it never reaches us |
| Account data (if you sign in) | Email address + plan status, stored with Supabase (EU region) | Us — never your analysis data |
| Billing | Handled by Stripe; we don't store card details | Stripe, under its own compliance |
These aren't statements in a policy document — they're HTTP security headers served with every page, which you can inspect on any response:
Content-Security-Policy: script-src 'self' … — only our own code runs; no third-party scripts, no trackers, no analytics beacons. Outbound connections are restricted to our own origin plus the account/billing and contact-form endpoints.
X-Frame-Options: DENY — the app can't be embedded and clickjacked.
X-Content-Type-Options: nosniff — browsers can't reinterpret content types.
Everything is served over TLS on Cloudflare's edge network with always-on DDoS protection.
General version of this question, for any vendor: the ICT third-party test.
Under DORA, ICT services your firm relies on belong in your Register of Information, with the contractual and risk overhead that brings. Whether a browser-delivered, zero-upload checker like CleanDesk falls into that bucket is an assessment your firm makes with its counsel — but the architecture facts that drive that assessment are unusual, and they matter:
Honest status: a formal, signed legal opinion on this question is planned but not yet published. Until it is, treat the above as architecture facts for your own assessment — not as legal advice.
CleanDesk contains no black box: the engines are deterministic rules mapped to the published requirements. The same input always produces the same findings, each cited to the rule it comes from. Evidence packs carry SHA-256 integrity hashes — re-running the same data reproduces the same hashes, so a reviewer can prove a report matches its input.
CleanDesk is decision-support, not a certification, and not legal advice. It flags what the published rules make checkable, drafts what can be drafted, and shows its working — your compliance officer reviews, decides and files, and regulatory responsibility stays with your firm. If a claim on this page ever stops being true, this page changes first.
| Provider | Role | Touches analysis data? |
|---|---|---|
| Cloudflare | Static hosting, CDN, DDoS protection | No |
| Supabase (EU) | Accounts — email + plan status only | No |
| Stripe | Billing | No |
Questions, or want this page's claims in writing for your vendor-risk file? Write to us — we answer plainly. Contact · Privacy · Terms