EditDocx Privacy Threat Model — What Local Browser Editing Protects
A practical threat model for EditDocx with citations to Microsoft’s cloud-save direction and clear residual risks — shared PCs, ads on the shell, IndexedDB, and what we do not claim.
“Files never leave your device” is a strong sentence. Over-reading it creates false confidence. This is the threat model behind EditDocx’s privacy claims: what we design for, what remains out of scope, and how to use the product without fooling yourself.
Pair with the Privacy Policy and edit without upload.
Why this conversation got louder in 2025–2026
Two industry moves matter even if you never open EditDocx:
- Word for the web stores working documents in OneDrive/SharePoint and autosaves there (Microsoft: browser vs desktop differences).
- Desktop Word has been testing cloud-first save defaults for Microsoft 365 Insiders (Microsoft announced mid-2025). Privacy analyses such as Proton on Word autosave to OneDrive highlight the shift from “local by default” toward “cloud by default.”
EditDocx is a third pattern: open an existing .docx / .xlsx in a tab, process document content locally, download when finished, create no EditDocx-side document mailbox.
Assets worth protecting
- Document content (text, tables, images, comments)
- Document metadata (author fields, revision residue)
- Account identity — EditDocx requires 0 accounts
- Device leftovers — IndexedDB recent files, Downloads copies
Trust boundary diagram
[Your file on disk]
|
v
[Browser tab: EditDocx] ---- document bytes stay here for editing
|
+---- network: app shell (JS/CSS/fonts), ads, consent, privacy-limited analytics
|
v
[Download to disk] = durable output you control
In-scope claim: EditDocx performs 0 server uploads of document content to EditDocx servers for the editing path.
Out-of-scope claim: The site is not an air-gapped appliance. Loading the shell uses the network. Google AdSense on the shell may use cookies/identifiers subject to consent rules (EEA/UK/CH). See the Privacy Policy.
Threat → mitigation → residual risk
EditDocx operator reads my NDA
- Mitigation: Document content is not uploaded to EditDocx servers for editing. There is no EditDocx document database of customer files.
- Residual: If you email support and attach an unredacted file, you shared it. Don’t. Describe symptoms instead (Contact).
Network eavesdropper on café Wi‑Fi
- Mitigation: editdocx.net is served over HTTPS/TLS.
- Residual: Endpoint malware can still read the tab or Downloads folder. Local editing does not defeat a compromised OS.
Cloud suite creates a second copy
- This is the threat EditDocx is good at reducing. Word for the web and Google Docs typically place files in OneDrive/Drive while editing.
- Residual: The next person you email may upload your download to their cloud. Your EditDocx session did not create that copy — their workflow might.
Shared / guest PC user after me
- Residual and important. IndexedDB can retain up to 10 files (20MB each) on that browser profile. Downloads may remain on disk.
- Mitigations: Private/incognito window; download to a controlled folder; clear site data; follow guest computer and locked-down PC guides.
Ads profiling document content
- Design intent: Document editing does not upload file content to EditDocx for ad targeting. Ads sit on the shell.
- Residual: Any webpage can host third-party scripts. Do not treat an ad-supported consumer site as a SCIF. For extreme classification levels, use only tools your security organization names.
Browser extension exfiltrates the DOM
- Residual. Malicious or over-privileged extensions can read page content. Prefer a clean profile for sensitive edits when policy allows.
“I hit Save so it is durable”
- Misconception. Ctrl/Cmd+S checkpoints browser storage. Lab profile wipes delete it. Download is the durable output.
Microsoft diagnostic / cloud ecosystem (context, not EditDocx)
Microsoft states that diagnostic data in Microsoft 365 excludes file content for that diagnostic channel — but cloud-stored documents are still cloud-stored documents. EditDocx’s claim is narrower and different: we do not host your document content on our servers for editing.
Recommended postures by sensitivity
| Sensitivity | Posture |
|---|---|
| Homework / casual memo | Normal browsing OK; still verify downloads |
| Offer letter / NDA on personal machine | Prefer EditDocx over personal Drive; verify; keep backups |
| Guest PC | Private window + clear data obligatory |
| Regulated / classified | Use only tools your security org approves |
Staff training card (five bullets)
- EditDocx does not keep your DOCX on its servers for editing.
- The website still uses the network for the app shell and ads.
- Shared PCs need private windows and clearing site data.
- Download is the real save; Ctrl+S is a local checkpoint.
- Extreme classification needs tools security names — not consumer web apps by default.
FAQ
Does local editing mean zero network?
No. Document content stays local for editing; the shell may still use the network.
Is IndexedDB encrypted?
Treat it as data on that browser profile. Clear it on shared machines.
Does AdSense read my DOCX?
Editing is designed not to upload file content to EditDocx for ads. Read the Privacy Policy for advertising technologies on the site shell.
Where should HR start?
HR confidential guide plus this model, and the Word Online alternative if the comparison is against Microsoft’s cloud path.
