Security
How Mungr protects your data with a zero-upload architecture, not a policy.
Architecture
Mungr's zero-upload architecture means your data files never leave your browser. All processing runs locally via WebAssembly (DuckDB-WASM). Our server never receives, processes, or stores your data.
Your data never reaches a server
Your file enters the browser, is cleaned locally by DuckDB compiled to WebAssembly, and is downloaded again. The only path that is never taken is the one to our backend, which handles authentication, recipe metadata, and billing only.
Because your data is processed where it already lives, there is no database encryption to manage, no server-side HIPAA infrastructure to run, and no transfer to log. "Compliant by architecture" is not a slogan; it is a diagram.
What our server handles
Only authentication, recipe metadata (transformation steps JSON, no data), billing, and user account management.
Network security
HTTPS-only, HSTS headers, secure cookie flags, CSRF protection, and Content Security Policy headers restricting data exfiltration.
WASM security
The WebAssembly module runs in the browser's sandbox. Subresource Integrity (SRI) hashes verify the WASM binary hasn't been tampered with.
Data in transit
Recipe metadata (steps only) transmitted over TLS 1.3. Zero user file data ever transmitted.
Data at rest
Account data encrypted at rest. No user file data stored.
Authentication
Session-based auth with bcrypt password hashing, optional two-factor authentication (TOTP), and passkey support (WebAuthn).
Vulnerability reporting
Contact hello@getmungr.com for responsible disclosure.
Compliance
See our HIPAA Notice and Privacy Policy for regulatory details.