ceu.tools

Privacy and threat model

Registrar in your browser has no account and no server. This page says what that means in practice, and names the one optional feature that sends anything off your device.

What stays local

Every activity, setting and evidence file is stored in this browser's IndexedDB for this site, and nowhere else. Certificates are read on the device: the PDF reader (pdf.js) and the text-recognition engine (tesseract.js) run in the page and in same-site workers, loaded from ceu.tools, never from a CDN. The Content-Security-Policy permits scripts only from this site and network connections only to this site, plus the two optional AI provider hosts below and localhost.

There is no analytics, no telemetry, no cookie, no account and no server-side copy, so there is nothing for ceu.tools to leak. Equally, nothing is backed up for you: clearing site data, a browser profile reset or a lost device loses the ledger. Export regularly. Anyone with access to this browser profile can read the ledger, as with any local file.

Registrar never asks for, stores or uses a certifying body's portal login. Packets are filled in by you.

What the bring-your-own-key option sends, and to whom

It is off by default. It sends something only when you set a key in Settings and press "Ask the model" on an activity.

  • What is sent: the text already extracted from that one certificate (at most 20,000 characters), a fixed instruction, the model name, and your key (as the provider's authentication header).
  • To whom: over HTTPS to the provider you chose, and only that one: Anthropic's API (api.anthropic.com), or an OpenAI-compatible endpoint (api.openai.com, or a model you run on localhost or 127.0.0.1). The site's security policy blocks every other destination.
  • What is never sent: the certificate file itself, your other activities, your settings or your export. The certificate text itself usually contains your name and the provider's, so treat it as personal data you are choosing to share.
  • The key is held in a JavaScript variable for that tab only. It is not written to IndexedDB, localStorage, cookies or exports, and a reload forgets it.
  • The provider sees the certificate text and your key, and handles them under its own terms. The model's answer fills the form, marked "llm", and you confirm it before anything is saved.

This website

ceu.tools is static files on Cloudflare Pages. Like any web host, Cloudflare handles each request, including your IP address and the page asked for; ceu.tools adds no analytics, tracking or cookies on top. The landing page and this page run no scripts at all.

Reporting a problem

Found a way data could leave the device, or a way Registrar could store a portal login? Please report it privately through GitHub private vulnerability reporting. The full threat model, with the tests that check these promises, is in the browser app's README.

Back to ceu.tools · Open Registrar