RepoBox is engineered with a strict Zero-Cloud, Local-First Architecture. We do not operate processing servers, do not store codebase archives, do not run user telemetry or advertising trackers, and never send your source code to external servers. Every byte is parsed inside your browser's local sandbox memory.
1. 100% Zero-Backend & Browser RAM Execution
When you drag and drop a folder, select a ZIP archive, parse documents (PDF/DOCX/XLSX), or fetch public web documentation, all file reading, decompression, Abstract Syntax Tree (AST) scanning, token estimation, and format transformations execute entirely inside your device's browser memory (using standard Web APIs such as FileReader, Web Workers, and TypedArrays).
2. Client-Side Secrets & Credentials Trap
To prevent accidental leaks before you paste context into AI models, RepoBox features an automated client-side security scanner. It automatically unchecks and masks sensitive configuration files and credentials by default:
- Environment files (
.env*) - SSH private keys (
id_rsa,id_ed25519) - SSL / TLS certs (
.pem,.key,.p12) - Cloud & Service tokens (AWS, GCP, Vault)
3. GitHub API & Personal Access Tokens
When using the GitHub Repo importer, requests are made directly from your browser to GitHub's official REST/GraphQL APIs (api.github.com). If you provide a GitHub Personal Access Token (PAT) for private repositories or elevated rate limits:
- Your token remains in transient JavaScript memory for that browser session only.
- Your token is never written to disk, never logged, and never routed through any proxy server.
- You can clear the token at any time by clicking "Reset" or refreshing your browser tab.
4. Local Storage & Zero Cookies
We use browser localStorage strictly for UI UX persistence:
- Theme Mode: Remembering your Dark/Light mode preference (
theme). - Export Options: Non-sensitive preferences such as chars-per-token ratio or line numbers.
RepoBox uses 0 advertising cookies, 0 third-party tracking scripts, and 0 user profiling telemetry.
5. Independent Verification Guarantee
You don't need to take our word for it. Any engineer can independently verify our zero-cloud guarantee in under 5 seconds:
6. GDPR, CCPA & Enterprise Compliance by Design
Because RepoBox never collects, stores, transmits, or processes personal data on remote servers, it satisfies the principles of Data Minimization and Privacy by Design under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). Enterprise developers can safely process proprietary codebases knowing their IP never leaves their workstation.
Have Privacy Questions?
Reach out to our security & privacy engineering team anytime.