Last updated: 14 August 2026.
This page is for whoever has to approve Walkstamp inside a company: how it works, what leaves your
machine, and what we do not have.
In one line: we never receive your files, there is no processing server, and there are no accounts. And you do not have to take our word for it — you can check in thirty seconds, with the browser you already have open.
Vendor assessments usually follow a checklist: where is the data held, who can access it, which certification do you hold, which processing agreement do we sign. That checklist assumes the vendor receives something.
In Walkstamp the entire process happens in your browser tab. The video is read from your disk by the browser itself, the images are extracted there, the audio is transcribed there, and the PDF, Word, ZIP and JSON files are assembled in the tab's memory and saved by the browser. There is no upload at any step. There is no temporary copy on our side, because there is no side of ours involved in the processing.
This does not make Walkstamp automatically approvable — it makes the conversation different. Instead of “trust their access controls”, the question becomes “does this really send nothing?”, which is a question you can answer yourself.
This is the most important part of the page, and it takes less time than reading it:
F12 to open the developer tools.A test your own security team runs is worth more than any statement of ours, which is why it is here instead of a badge.
There is a single HTML file with the whole tool inside. You download it, disconnect the network, open the file, and it works. Nothing in it talks to any server.
And that is not a promise in prose: the process that produces that file fails the build if any measurement address is left inside it. It is a lock in the pipeline, not an intention. You can verify it by searching the downloaded file for “supabase” or “insights” — there are no matches.
In the offline version you lose automatic transcription (the speech model is downloaded on demand), text recognition from images, and the Google Drive button. Everything else works the same. It can also be stored in an internal repository, scanned by your team, and distributed without depending on us.
| Connection | When it happens | What goes | What never goes |
|---|---|---|---|
| Vercel (hosting) | Always, when the page loads | The request for the page file, with IP and browser — as on any website | Your content |
| Vercel Web Analytics | Always; not sent if the browser signals Do Not Track or Global Privacy Control | Which page was viewed, with no cookie and no identifier that persists | Any person or session identifier |
| Supabase (usage milestones) | At three moments: tool opened, video opened, output downloaded. Respects DNT and GPC | The milestone name, the page language, where the video came from, and the format downloaded | File name, size, duration, content, session identifier |
| jsDelivr (public CDN) | Only when using automatic transcription or text recognition | The request for the library | Your audio, your images, your text |
| Hugging Face | Only when you start automatic transcription, and once per browser | The request for the speech model | Your audio |
| Only if you click to open a video from Drive | Authentication and the request for the file you pick, with the narrowest scope available (drive.file) |
The rest of your Drive; and the file goes from Google straight to your browser, never through us |
None of these connections carries video, audio, images, transcripts or generated documents. The PDF library is served from our own domain, not from a CDN.
None of your content is kept between visits. The evidence identification fields — test case, who ran it, system — live only in the tab's memory and disappear when you close it; that was a deliberate decision, and it is why you retype them when you come back.
The only thing that persists is the transcription model, cached by the browser itself so it is not downloaded again. It sits on your device, under your control, and is removed when you clear browsing data. We use no cookies — neither our own nor third-party ones.
This is the part almost no vendor writes, and precisely the part your team needs. We hold no security certification, and we are not in the process of obtaining one. Below is what each one means and why it does — or does not — apply to a tool that receives no data.
| Standard or certification | Do we hold it? | What that means here |
|---|---|---|
| ISO/IEC 27001 | No | It certifies the information security management system of an organisation that holds data. We do not hold yours. If your policy requires ISO 27001 from every vendor that receives data, it is worth recording that here there is no receiving — but whether the exception applies is your team's call, not ours. |
| SOC 2 (Type I or II) | No | It audits controls at a service organisation that processes customer data. There is no service processing anything: the processing is on your computer. |
| 21 CFR Part 11 (FDA) | No | It requires a validated closed system, an audit trail and electronic signatures. A document generator in a browser does not and cannot meet that on its own. In a Part 11 environment Walkstamp can produce the image, but the controlled record has to live in your validated system. |
| CSV / GAMP 5 | No | Computerised system validation happens in your environment, for your use. It is not something a vendor hands over finished. |
| SOX / ITGC | Not applicable as a certification | Walkstamp is not an IT control. It produces the evidence that feeds your control. The control is still yours to answer for. |
| HIPAA — business associate agreement | We do not sign one | We receive no data, so the relationship the agreement would formalise does not exist. If your policy requires an agreement with any tool that touches health data, even locally, talk to your compliance team — we are not going to say it is fine when that call is not ours. |
| LGPD / GDPR | Not a certification | There is no such thing as a “GDPR certificate”. Our position, legal bases and retention periods are described in the Privacy Policy. |
| Penetration test report | We have none | There is no infrastructure to test beyond static file hosting. What exists is the code that runs on your machine — and it is readable. |
| Cyber liability insurance | No | We are a small company and it would not be honest to imply coverage that does not exist. |
Ctrl+U shows all of it. There is no server-side code because there is no server.Walkstamp is offered by Produtize Produtos e Serviços Inteligentes Ltda., Brazilian company registry (CNPJ) 48.417.292/0001-99.
To report a security issue, ask for clarification for a vendor assessment, or request the offline version: privacidade@walkstamp.com. There is no bug bounty programme, but we do answer.
This page describes how things work as of the date above. If anything changes in a way that affects what is written here, this page changes with it — and the date at the top is how you check that.