100% In-Browser & Private

Cyber Resilience & Security Policy

Effective Date: October 20, 2026 | Last Reviewed: October 20, 2026

Everyday Tools is engineered in compliance with the EU Cyber Resilience Act (CRA – Regulation (EU) 2024/2847) and international cybersecurity standards. We apply strict Security-by-Design and Security-by-Default principles across all 290 web utilities to protect digital users from threats and vulnerabilities.

1. EU Cyber Resilience Act (CRA) Compliance & Architectural Principles

Under the Cyber Resilience Act framework, digital products and online utilities must adhere to core essential requirements (Annex I):

  • Security by Design: Everyday Tools eliminates the primary attack vector of traditional web utilities—remote server execution—by processing 100% of tool computations inside the user’s local browser sandbox.
  • Minimization of Attack Surface: We do not operate remote computational queues, remote execution environments, or user database repositories for sensitive tool inputs.
  • Data Confidentiality & Integrity: Client-side cryptographic operations leverage the native browser window.crypto.subtle Web Crypto API, ensuring deterministic, hardware-accelerated execution without exposing secrets over network connections.
  • Encrypted Transport: Full enforcement of Transport Layer Security (TLS 1.3) with HTTP Strict Transport Security (HSTS) and secure cookie flags.

2. Coordinated Vulnerability Disclosure (CVD) Policy

In accordance with Article 11 of the Cyber Resilience Act, Everyday Tools maintains a formal, transparent Coordinated Vulnerability Disclosure policy:

  • Standard Security Contact: In compliance with RFC 9116, our security contact point is declared at /.well-known/security.txt.
  • Reporting Address: Security researchers may submit vulnerability findings directly to [email protected].
  • Safe Harbor Statement: Everyday Tools will not initiate legal action against cybersecurity researchers who discover and report security vulnerabilities in good faith, provided that:
    • Testing does not cause Denial of Service (DoS) or degrade service for legitimate users;
    • No private user data or server logs are accessed, exfiltrated, modified, or destroyed;
    • Findings are disclosed to us privately and reasonable time is granted for remediation prior to public disclosure.
  • Remediation Service Level Agreements (SLAs):
    • Initial Acknowledgement: Within 24 business hours.
    • Triage & Impact Assessment: Within 48 business hours.
    • Patch Deployment & Release: Within 7 calendar days for critical/high vulnerabilities; within 14 calendar days for medium vulnerabilities.

3. Software Bill of Materials (SBOM) & Component Inventory

To mitigate software supply chain risks mandated under CRA Article 10, Everyday Tools enforces strict dependency minimalism:

  • Zero Runtime NPM/CDN Bloat: Our tool runtime uses 100% pure vanilla ECMAScript 6+ and native browser Web APIs without unverified external JavaScript CDN scripts or third-party execution wrappers.
  • Native Web APIs: Cryptographic hashing is performed via native Web Crypto API; image processing runs in native HTML5 Canvas; file inspection runs in native FileReader.
  • Subresource Integrity & Security Headers: All styles and scripts are hardened with defensive Content Security Policies, nosniff MIME enforcement, and frame denial.

4. Incident Handling & Regulatory Notification

In the unlikely event of an actively exploited cybersecurity vulnerability or significant incident affecting the portal infrastructure, Everyday Tools adheres to statutory notification timelines under the CRA, cooperating with the European Union Agency for Cybersecurity (ENISA), competent national CSIRTs, and the Indian Computer Emergency Response Team (CERT-In).

5. Security Acknowledgments & Hall of Fame

We believe in recognizing the vital contributions of the ethical security research community. Security researchers who submit valid, original, and actionable vulnerability reports that lead to remediation will be permanently acknowledged in our Security Hall of Fame (subject to researcher consent).