How to analyze confidential data without uploading it

Most convenient data tools are hosted, which means using one on customer records, payroll, or patient data is a disclosure decision rather than a technical one. Browser-based execution removes that trade-off — the same convenience without the file leaving the machine.

What "uploaded" actually means

When a hosted tool accepts a file, that file is written to a server you do not control, usually replicated, often retained after the session ends, and readable by that vendor's staff and anyone who compromises them. Deleting it afterwards does not undo the transfer.

For data covered by GDPR, HIPAA, or an ordinary customer confidentiality clause, this is the step that creates the obligation — not the analysis itself.

How browser-based execution avoids it

WebAssembly lets a real database engine run inside the browser tab. NoEgress ships DuckDB compiled to WebAssembly, so when a file is opened, the browser reads it from disk into the tab's own memory and the query executes there.

The distinction that matters: the engine travels to the data rather than the data travelling to the engine. There is no upload endpoint in the application, so there is no server-side copy to secure, retain, or delete.

Verify it rather than believing it

Privacy claims should be checkable. Open your browser's developer tools, switch to the Network tab, and open a file. You will see requests for the application code and the WebAssembly engine, and none carrying your file's contents.

A stronger test: load the page once, disconnect from the network, then open a file and run queries. Everything continues to work, because nothing in the query path needs a server.

What about the AI assistant?

The optional assistant runs a small open-weight model locally through WebGPU. The model weights are downloaded once and cached in the browser; after that, prompts, your schema, and query results are processed on your device rather than sent to a model provider.

It is genuinely optional — the SQL workbench, pivots, profiling, and charts all work without ever loading a model.

Where the data does persist

Opened datasets are cached in the browser's own storage (OPFS) so a reload does not require reopening the file. That storage is local to your machine and profile, and clearing site data removes it. Nothing is synced.

When this is the right approach

Browser-based analysis fits exploratory work on sensitive files: reviewing an export before sharing it, checking a vendor report, profiling customer data, or answering an ad-hoc question about payroll. For scheduled pipelines and shared dashboards you still want a real warehouse — the two solve different problems.