Security and privacy by design
The design rule behind ExhibitSet is that your documents never leave your computer. This page explains what that means, what we can and cannot see, and how to check it yourself.
What runs where
ExhibitSet is a browser application. When you open a PDF, the file is read by your browser from your disk and handed to a PDF engine that runs as WebAssembly inside the same tab. Rendering, text extraction, search, redaction, stamping, assembly and export all happen there. The output is written back to your disk by your browser's normal download mechanism.
The only network traffic the application generates is to fetch its own code from app.exhibitset.com. The engine, its fonts and every script are served from that one origin; nothing is loaded from third-party content networks. When account features launch, the application will also talk to our account service, which will store account and matter metadata such as a matter name and a Bates prefix, and never a document.
What we can see
| Data | Do we receive it? |
|---|---|
| Document content, images, text layers | Never |
| File names, page counts, Bates ranges you apply | Never |
| Production and redaction logs | Never; they are generated on your machine and downloaded by you |
| Your login and matter names, once accounts exist | Yes, and only that |
| Website analytics on exhibitset.com | Yes, unless your browser sends Global Privacy Control or Do Not Track |
How to verify it yourself
- Open app.exhibitset.com in Chrome or Edge and press F12 to open developer tools. Select the Network tab.
- Open a PDF, run a search, mark and apply a redaction, and download the result.
- Review the request list. Every request goes to app.exhibitset.com and fetches application code or assets. None carries your document, and the request sizes make that obvious.
- For a stronger test, load the page, then turn off Wi-Fi. Everything above still works, because nothing depends on a server.
You can also inspect the response headers of any page. The Content-Security-Policy header on app.exhibitset.com restricts scripts and connections to the application's own origin, so even a bug in the code could not send data elsewhere without the browser blocking it.
Controls in place today
- All traffic over HTTPS with HTTP Strict Transport Security.
- A Content Security Policy on every page, enforced as a response header, with connections limited to our own origin on the application.
- No third-party scripts in the application. The website carries one analytics tag, disabled for privacy-signal browsers and for visitors in the EEA, UK and Switzerland, disclosed in our privacy policy.
- Framing denied, MIME sniffing disabled, a strict referrer policy, and browser features such as camera, microphone and geolocation switched off by policy.
- Deployments built from source control by an automated pipeline. Every change is reviewed for licensing and security before it is merged.
- Every export is a full rewrite of the PDF: earlier revisions, orphaned objects and document metadata do not survive into the file you produce.
- Redactions are verified after they are applied. The application searches the document again for every marked text term before it reports success, and refuses to report success if any term is still found or could not be checked. Area marks are not yet text-verifiable, and the application says so at the time.
What we will not claim
We will not describe ExhibitSet as "SOC 2 certified", "HIPAA compliant" or "court approved" unless and until those statements are true and documented. We will not describe the source as public, because it is not. What we will do is make every privacy claim on this site checkable by you in your own browser.
Reporting a vulnerability
If you find a security issue, email hello@exhibitset.com with "Security report" in the subject. Our security.txt file carries the same contact. We ask that you give us a reasonable time to fix an issue before publishing it, and we will credit you if you want.
Frequently asked questions
Where does the PDF processing happen?
Entirely inside your browser tab, using a PDF engine compiled to WebAssembly that ExhibitSet serves from its own domain. No document bytes are transmitted.
How can I verify that nothing is uploaded?
Open Chrome's developer tools, select the Network tab, then open and redact a PDF. You will see requests only for the application's own code, none carrying document data. You can also disconnect from the internet after the page loads and keep working.
Does ExhibitSet have a SOC 2 report?
Not yet, and we will not claim one until we have it. Because documents never reach our systems, the scope of any future audit is the account and billing service only.