Security & Privacy

RovoTools is local-first: tools run in your browser whenever technically possible, so your files, passwords, tokens and documents never travel over the network. We never log tool inputs or uploaded file contents.

Protections

• Secure headers including Content Security Policy, HSTS and frame protection.
• Server-side input validation with strict schemas and rate limits on APIs.
• File type and size validation before any processing.
• No secrets in client-side code; configuration via environment variables.

Found a vulnerability? Please report it responsibly to support@rovotools.com. See our Privacy Policy for data handling details.