CleanDesk's security model isn't a promise — it's the architecture. The compliance engines run inside your browser, so your register, transaction and customer data never reach our servers. This page lays out exactly what that means, what we hold, and how you can verify every claim yourself.
Every check — DORA register validation, AML screening and monitoring, market-abuse surveillance, CRA scope and SBOM/KEV — executes as JavaScript in your browser, against rule sets and list snapshots bundled with the site. Your file is read locally, processed locally, and stays local. There is no upload endpoint for a register, a tape, a roster or a document.
Verify it yourself in two minutes: open your browser's developer tools (Network tab), load a register or transaction file into any CleanDesk tool and run the check. You'll see the page's static assets load — and no request carrying that data. Two optional lookups are the exception and are listed in the sub-processor table below: a UK company name or number you type, and a name you screen through your own provider account. Neither is connected in this build. The strongest data security is data we never hold.
| Data | Where it lives | Who can see it |
|---|---|---|
| Registers, transaction tapes, KYC & customer data, SBOMs | Your browser only (memory + this browser's local storage, if you choose to save) | Only you — it never reaches us |
| Account data (if you sign in) | Email address + plan status, stored with Supabase (EU region) | Us — never your analysis data |
| Billing | Handled by Stripe; we don't store card details | Stripe, under its own compliance |
These aren't statements in a policy document — they're HTTP security headers served with every page, which you can inspect on any response:
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://challenges.cloudflare.com; connect-src 'self' https://*.supabase.co; frame-ancestors 'none'; base-uri 'self' — that is the whole directive, not a summary of it. One third-party script origin, Cloudflare Turnstile, which is the bot check on the sign-in form. No trackers and no analytics. Outbound connections are limited to our own origin and Supabase, which holds accounts. Inline script is still permitted, which is a real weakness we have not yet removed.
X-Frame-Options: DENY — the app can't be embedded and clickjacked. The one exception is /embed/*, the public widgets, which are meant to be framed and carry no account data.
X-Content-Type-Options: nosniff — browsers can't reinterpret content types.
Everything is served over TLS on Cloudflare's edge network with Cloudflare's own DDoS protection.
General version of this question, for any vendor: the ICT third-party test.
Under DORA, ICT services your firm relies on belong in your Register of Information, with the contractual and risk overhead that brings. Whether a browser-delivered, zero-upload checker like CleanDesk falls into that bucket is an assessment your firm makes with its counsel — but the architecture facts that drive that assessment are unusual, and they matter:
Honest status: a formal, signed legal opinion on this question is planned but not yet published. Until it is, treat the above as architecture facts for your own assessment — not as legal advice.
CleanDesk contains no black box: the engines are deterministic rules mapped to the published requirements. The same input always produces the same findings, each cited to the rule it comes from. Evidence packs carry SHA-256 integrity hashes — re-running the same data reproduces the same hashes, so a reviewer can prove a report matches its input.
CleanDesk is decision-support, not a certification, and not legal advice. It flags what the published rules make checkable, drafts what can be drafted, and shows its working — your compliance officer reviews, decides and files, and regulatory responsibility stays with your firm. If a claim on this page ever stops being true, this page changes first.
| Provider | Role | Touches analysis data? |
|---|---|---|
| Cloudflare | Static hosting, CDN, DDoS protection | No |
| Supabase (EU) | Accounts — email + plan status only | No |
| Stripe | Billing | No |
| Companies House | UK company ownership lookup, a company name or number you type | No key configured, so Companies House receives nothing. The name reaches our own server, which declines it and stores nothing |
| ComplyAdvantage | PEP and adverse-media search through your own account, a name you type | Not connected in this build |
Questions, or want this page's claims in writing for your vendor-risk file? Write to us — we answer plainly. Contact · Privacy · Terms