GDPR and document conversion: what 'in-browser' really means for compliance

The General Data Protection Regulation is precise about who does what to personal data. A controller decides why data is processed. A processor acts on the controller's behalf. The moment a file leaves your device and reaches someone else's server, that someone becomes a processor and you have paperwork to do.

In-browser tools change the arithmetic. When nctools's PDF-to-Word converter runs entirely inside your tab, no data ever reaches us. We are not a processor. There is no Data Processing Agreement to sign, no sub-processor list to disclose, no cross-border transfer to justify.

The technical proof

Anyone can inspect it. Open the browser's Network tab, run a conversion, and confirm the only requests are for static assets — HTML, JavaScript, WebAssembly binaries, font files. The document itself never appears in an outbound request.

Where the boundary sits

Not every nctools feature is local. Sign-in, billing, and team dashboards run on nctools Cloud (our managed backend). Any personal data we store — email, workspace name, subscription state — is documented in our privacy policy and covered by a standard DPA. Document contents never touch that server.

• Local: PDF → Word, PDF → Excel, PDF → OCR, OCR → Text, Paste → PDF.
• Server: authentication, billing, usage counters (per-workspace, not per-file).
• Never: your document bytes, their filenames, or their contents.

What auditors want to see

If you are pitching nctools to your DPO, they will ask three things. First, is the tool a processor? Answer: no, for the conversion features. Second, where does data flow? Answer: nowhere, for the conversion features. Third, can you prove it? Answer: yes, via network trace and open-source components.

Cross-border considerations

The Schrems II ruling made server-based US processing suddenly expensive. In-browser tools sidestep the question entirely — there is no transfer. For EU-based teams working with US-headquartered vendors, this is often the deciding factor.

Compliance is not a spec sheet. It is a series of trade-offs. In-browser conversion is one of the trades that pays off across almost every axis.