Security
Know where your data is processed.
KitLumi uses runtime labels to distinguish browser-only tools from features that need an external service. Forty-one current tools are Local Only. IP Lookup is API-backed and identifies its primary and fallback providers before the user starts the request.
Local processing boundary
Text processing, hashing, generation, canvas conversion, PDF processing, copying, and download preparation for Local Only tools run in the current browser tab. Larger or potentially slow work may run in a Web Worker on the same origin, not on a processing server.
External request boundary
After an explicit action, IP Lookup sends the requested address directly to ipquery.io. A network error, HTTP 429, or HTTP 5xx retries the same request through ipwho.is; validation failures and other client errors do not. Every contacted provider also receives the connection IP as part of the network request. Avoid using the lookup with an address you do not want disclosed to either service.
Both responses are treated as untrusted external data and mapped defensively before display. Geolocation remains approximate, and the free endpoints provide no availability SLA to KitLumi. Do not use the result to identify a person or make a high-impact decision.
Browser and device boundary
Local processing does not protect data from a compromised device, untrusted browser extension, screen recording, shared clipboard history, or organization-level browser monitoring. Use an appropriate device and browser profile for production secrets.
Dependency and release checks
The application uses a static frontend stack and automated tests for core transformations, catalog integrity, and production builds. Production deployments should pin reviewed dependency versions and run the check, test, and build commands before release.
Last reviewed: