crosstabs.
Open navigation
OpenOpen workspace

Security and privacy

Browser analysis and the local MCP keep source rows on your device. Neither requires an account, and no Crosstabs service accepts respondent files.

Last updated

The product boundary

There are no accounts. Browser and local MCP analysis keep files on your device.

The full boundary
  • There are no user accounts or sign-ups. Browser projects remain local; there is no server-side project storage or cloud sync.
  • Files imported through the browser analysis app are parsed locally and are not uploaded to Crosstabs.
  • Saved projects use versioned browser IndexedDB when available, with a localStorage compatibility fallback. You control deletion and backups.
  • Portable .ctproj files let you back up or move a project without creating a server copy.
  • The public statistical API accepts only the contingency-table aggregates explicitly included in a request. It does not accept or persist respondent rows or projects.
  • Local MCP tools can analyze data from your own machine without sending project rows to a Crosstabs-operated data plane.

Warehouse connections

Warehouse imports run from your browser directly to BigQuery, Snowflake, Databricks, MotherDuck or Supabase with your own credentials. Crosstabs receives no credentials, queries or rows.

How warehouse connections are bounded
  • Credentials live only in the tab's memory for the session. They are never placed in projects, browser storage, URLs, exports, logs or telemetry, and Forget, a completed import, or closing the tab discards them.
  • Only a single read-only SELECT (or a PostgREST GET) is sent. This check is a convenience; the permissions of the account or token you supply remain the real control, so prefer read-only roles and keys.
  • Supabase service-role and secret keys are refused because they bypass row-level security. Use the anon or publishable key, optionally with a signed-in user's token.
  • The Content Security Policy allows connections only to the providers' fixed hosts or per-account subdomains (*.snowflakecomputing.com, Databricks workspace hosts, *.supabase.co), never to arbitrary origins. Google sign-in and MotherDuck's WebAssembly client load scripts from their own hosts only after you choose them.
  • PostgreSQL, MySQL, SQL Server and Oracle cannot be reached from a browser; the local bridge runs those queries on your computer instead.

Local bridge

crosstabs connect is a program you run on your own computer. It reads a database table, survey-platform responses or a CSV folder and hands the result straight to the crosstabs.com window that opened it; no Crosstabs server sits in between.

How the bridge is protected
  • The bridge listens on 127.0.0.1 only and refuses requests whose Host header is not its own loopback address, which blocks DNS-rebinding pages.
  • crosstabs.com never fetches the bridge. It opens the bridge's own page in a pop-up window, so no cross-origin, mixed-content or local-network subresource request is made from crosstabs.com.
  • A one-time pairing code shown in your terminal must be typed into the bridge window before any source is listed. Five wrong codes replace the code.
  • The bridge sends data only with postMessage addressed to the exact crosstabs.com origin, and the workspace accepts it only from the bridge window it opened, with a matching random nonce and SHA-256 checksum.
  • Database credentials and survey-platform tokens come from environment variables you name or are typed into the bridge window and kept in its memory; they are never sent to crosstabs.com or put in a URL. Only single SELECT or WITH statements run, on a read-only session where the database supports one; use a read-only login for databases that do not.
  • The bridge sends no CORS headers, uses a strict Content-Security-Policy, and stops after 30 minutes without use.

Sharing and exports

Share links keep aggregates in the URL fragment but work like bearer links that cannot be revoked. CSV exports neutralize spreadsheet formulas, and PDF and XLSX reports carry their analysis settings.

Links, exports and imports
  • Aggregate result links put counts, labels, and selected context in a URL fragment. Browsers do not send the fragment to the website in HTTP requests or referrer headers.
  • A complete aggregate result link is still a bearer disclosure: anyone who receives it can read its contents. Fragment encoding is not encryption and links cannot be revoked remotely.
  • CSV exports sanitize cells that spreadsheet software could otherwise interpret as formulas.
  • PDF and XLSX reports include analysis settings and audit metadata so the method travels with the result.
  • Portable project imports verify schema versions, inventory, and SHA-256 checksums before creating a new local copy. Checksums detect changes but do not authenticate the sender.

Operational telemetry

Logs and error reports exclude source rows, files, project contents and prompts, and analytics strips query strings and fragments. Telemetry is never used to rebuild an identity or a project history.

What telemetry may contain
  • Operational logs and error reports must exclude source rows, uploaded files, project contents, prompts, exports, and browser-storage values.
  • Page analytics is disabled on aggregate snapshot routes and strips query strings and fragments before collection.
  • Health and fixed-shape error endpoints may report coarse release, route, browser, and failure-category information needed to operate the public site. A browser error report may add the page path without its query, the open workspace mode, the error type, a short hash of the code location, the browser family and major version, and the interface language; never the error message, file names, variable names, labels or respondent values.
  • Crosstabs does not use telemetry to reconstruct a user identity or a project history.

Your responsibilities

Back up important work as a .ctproj file, share links and exports only with people allowed to see them, and follow your organization's data policy.

All four responsibilities
  • Keep a .ctproj backup if the work matters. Browser storage is convenient local storage, not a synchronized or encrypted backup service.
  • Only share aggregate links and exports with people who are allowed to see their contents.
  • Use your organization’s device, browser, and data-handling policy for sensitive datasets.
  • Review methodology and disclosure notes before publishing a result; software cannot replace accountable research judgment.