Security Policy

1. Zero-Trust Client-Side Security Architecture

Unlike conventional SaaS platforms that upload files, documents, and form inputs to remote backend cloud servers for processing, Toolspot by Tradesala operates on a strict Zero-Trust Client-Side Architecture.

All 60+ micro-applications hosted on Toolspot — including document utilities (Merge PDF, Split PDF, Compress PDF, PDF to Word, eSign, Redact, Protect, Unlock), financial modeling tools (Income Tax, EMI, SIP, NPS, FIRE, Gratuity, NPV), health calculators (BMI, BMR, TDEE, Diabetes Risk, Blood Pressure), and developer tools (Password Generator, JSON Formatter, QR Code) — compile and execute exclusively inside your web browser's local sandbox using WebAssembly (WASM), HTML5 WebCrypto API, Canvas API, and local JavaScript workers.

2. Cryptographic Standards & In-Browser Privacy

To maintain maximum privacy and prevent local memory tampering or eavesdropping, Toolspot implements modern cryptographic standards directly inside the browser environment:

• Cryptographically Secure Random Numbers (CSPRNG): Tools like the Password Generator and cryptographic token generators rely strictly on `window.crypto.getRandomValues()` to provide high-entropy randomness resistant to prediction attacks.
• Client-Side Document Encryption: PDF Protection and Password Unlocking run client-side using WebCrypto and native JS libraries without revealing passwords or keys over the network.
• Volatile Memory Isolation: All intermediate data buffers created during document parsing or compression exist solely in temporary JavaScript heap memory and are released when DOM nodes or web workers terminate.

3. Network & Transport Security (TLS 1.3 & HSTS)

Although user data remains client-side, all code and static assets delivered to your browser are protected by strict network security transport standards:

• Enforced HTTPS / TLS 1.3: Plain HTTP connections are automatically redirected to HTTPS via 301 Permanent Redirects. All traffic uses TLS 1.3 with forward-secrecy ciphers;
• HTTP Strict Transport Security (HSTS): Max-age headers enforcing HTTPS for at least 1 year (31,536,000 seconds) with `includeSubDomains` and `preload` directives;
• Security Headers: We enforce rigid browser security headers on every response:
  • X-Frame-Options: DENY (Prevents Clickjacking attacks);
  • X-Content-Type-Options: nosniff (Prevents MIME sniffing exploits);
  • Referrer-Policy: strict-origin-when-cross-origin (Prevents sensitive path leaking);
  • Permissions-Policy: camera=(), microphone=(), geolocation=() (Disables unused hardware access).

4. Edge Infrastructure, WAF & Anti-DDoS Protections

Toolspot is delivered globally via Cloudflare, Inc.'s high-speed Content Delivery Network (CDN) and Anycast DNS network. This infrastructure layer provides enterprise-grade perimeter security:

5. Content Security Policy (CSP) & Subresource Integrity (SRI)

To safeguard against Cross-Site Scripting (XSS), data exfiltration, or malicious script injection, Toolspot enforces a strict Content Security Policy (CSP) and Subresource Integrity checks:

• Strict CSP Directives: Restricts script execution, frame embedding, and network connection endpoints to verified origins (`'self'`, official Google Analytics endpoints, and trusted CDNs);
• Subresource Integrity (SRI): External open-source libraries (e.g. JSZip, PDF.js) loaded via CDNJS are cryptographically validated against SHA-256/SHA-384 integrity hashes to guarantee that code has not been tampered with;
• No Dynamic Code Execution: Avoids unsafe `eval()` construct usage in application business logic to mitigate code-injection attack surfaces.

6. OWASP Top 10 Security Checklist

Tradesala maintains compliance with the Open Web Application Security Project (OWASP) Top 10 security standards:

• A01: Broken Access Control: Client-side execution eliminates unauthorized backend privilege escalation vectors.
• A02: Cryptographic Failures: All transit is encrypted via TLS 1.3; browser random generation uses CSPRNG.
• A03: Injection: Input sanitization and zero SQL/NoSQL backend database query execution prevent injection.
• A04: Insecure Design: Zero-Trust architecture ensures privacy and security by design.
• A05: Security Misconfiguration: Hardened HTTP response headers and Cloudflare edge WAF rules enforced.
• A06: Vulnerable & Outdated Components: Continuous monitoring of open-source JS dependencies via `npm audit` and SRI verification.
• A07: Identification & Authentication Failures: No user registration or passwords stored on server; no credential leakage risks.
• A08: Software & Data Integrity Failures: CDNJS dependencies locked to exact release hashes via SRI.
• A09: Security Logging & Monitoring Failures: Edge security monitoring for DDoS and intrusion alerts without storing user payload content.
• A10: Server-Side Request Forgery (SSRF): Client-side browser execution prevents SSRF attacks against internal networks.

7. Vulnerability Disclosure Program (VDP) & Safe Harbor

Tradesala deeply values the contributions of ethical security researchers, penetration testers, and the cybersecurity community. If you discover a potential security flaw, vulnerability, or exposure on toolspot.tradesala.net, we encourage you to report it to us immediately.

Scope & Reporting Guidelines

• In-Scope Targets: Web applications on toolspot.tradesala.net, static JavaScript modules, security header configurations, CSP bypasses, or client-side data leakage vectors.
• Out-of-Scope Targets: Social engineering / phishing against Tradesala staff, physical security attacks, volumetric DDoS attacks, spamming, or automated scanner reports without proof-of-concept.

Safe Harbor Policy

If you conduct security research in good faith and in compliance with this policy:

• We will not initiate legal action or report you to law enforcement Authorities;
• We will work with you to understand and resolve the vulnerability promptly;
• We request that you allow us a reasonable resolution timeframe (typically 7 business days) before disclosing details publicly.

How to Submit a Security Finding

1. Send an encrypted or detailed report to [email protected] (or [email protected]) with the subject "Vulnerability Disclosure Report — [Short Description]";
2. Include step-by-step reproduction steps, proof-of-concept (PoC) code or screenshots, and affected URL endpoints;
3. Our Security Incident Response Team (SIRT) will acknowledge receipt within 24 hours and provide status updates until remediation is complete.

8. Statutory Security Compliance & Standards

Toolspot's technical security measures comply with international and regional cyber security regulations:

• India IT Act 2000 & DPDPA 2023: Full compliance with Section 43A (Reasonable Security Practices) and Section 8 (Data Security Safeguards);
• EU GDPR Article 32: Implementation of appropriate Technical and Organizational Measures (TOMs) for security of processing;
• US NIST Cybersecurity Framework (CSF): Adoption of Identify, Protect, Detect, and Respond core principles.

9. Corporate Security Desk Contact

For official security inquiries, vulnerability reports, or compliance audits, contact our corporate security team:

Security Notice: This Security Policy is maintained by Tradesala Technologies Pvt Ltd. All rights reserved. Last audited July 2026.