Is it safe to paste a contract into an online tool?

The honest answer

It depends on the tool, and the difference between two tools that look identical can be total. Two comparison pages can present the same panes, the same buttons and the same result, while one of them does the work in your browser and the other sends what you pasted to a server in another country.

Both are legitimate ways to build software. Neither is disclosed by the interface. And reassuring language on the marketing page — "secure", "bank-level encryption", "we take your privacy seriously" — tells you nothing about which one you are looking at, because it is equally true of a tool that receives your document and handles it carefully.

Two kinds of online tool

Server-side. Your text is sent to the operator's servers, processed there, and the result is sent back. This is how most web applications work and it is not sinister — it is often the only way to do the job. But it means your text has been received by somebody else's computer, may be logged, may be cached, may be retained, and is subject to whatever the operator's policies and jurisdiction say.

Client-side. The page downloads the program once, and the program runs inside your browser on your machine. Your text is never transmitted, because there is nothing to transmit it to. The operator could not read what you pasted if they wanted to.

For a comparison tool, either is technically possible. Which one you are using is a question of fact, and here is how to answer it.

The offline test

This is the decisive one, and it needs no technical knowledge at all.

1. Open the tool and let the page finish loading.
2. Turn off your wi-fi, or disconnect from the network.
3. Paste your two versions in and use it.

If it still works, the work is happening on your machine. A tool that needs a server cannot produce a result without one — it will hang, fail, or show an error. There is no way to fake this: either the answer appears with the network off, or it does not.

Do it once, with text that does not matter, before you use the tool for anything real. Two minutes, and you never have to wonder again.

The network tab

The second check shows you what actually leaves the page. Every modern browser has developer tools — F12 on Windows, ⌥⌘I on a Mac, or Developer Tools from the browser's menu — and a Network tab listing every request the page makes.

1. Open the Network tab before you paste anything, so you see the requests as they happen.
2. Paste your two versions in and use the tool.
3. Watch what appears in the list.

A page doing the work locally makes no requests at all while you type, or makes only small ones unrelated to your text. A page sending your text to a server makes a request each time — and you can click any request and look at what it carried. If your clause is in there, you have your answer.

Be prepared to see requests that are not your text. Analytics, fonts and error reporting all make requests, and most sites have some. What matters is whether any of them contains what you pasted, which you can check by looking.

Reading the policy

The third check is the privacy policy, read for what it says rather than for its tone. Specific, falsifiable statements are worth something; general assurances are not. Two useful questions:

• Does it say the text is not transmitted, or that it is handled carefully?"We do not store your documents" means the documents were received and then discarded, which is an entirely different fact from never having been sent.
• Does it name what does leave, and where it goes? A policy that names its analytics provider, its email provider and its host has been written by somebody who checked. A policy that says only that your data is safe has not.

What these checks do not prove

They tell you what the page did, in your browser, on the day you looked. They do not guarantee it will behave the same way next month, and no check available to a user can. A site can change; that is true of everything on the internet.

They also say nothing about the rest of your working environment: a browser extension can read what is on a page, a managed device may log what you type, and a shared machine is a shared machine. Those risks are unaffected by which comparison tool you use.

What the checks do establish is the one thing that is otherwise unknowable from the interface, and it is the thing that matters: whether the text reached anybody else's computer at all.

What this tool does

Redline Pad runs the comparison in your browser. Nothing you paste is transmitted, and both checks above will confirm it: the tool works with the network off, and the Network tab shows no request carrying your text.

Two details worth knowing before you look, so nothing surprises you.

The page is served with a Content-Security-Policy whose connect-src directive is 'self'. That is a rule enforced by your browser rather than a promise made by this site: the page is not permitted to contact any other origin, and an attempt to would be blocked and reported in the console. You can read the header on the page's own response in the Network tab.

You will also see occasional small requests to this site itself with a query string on them. Those are the analytics, which count a page view and record that a comparison was run or that a copy button was pressed. They are names and nothing else — no counts, no lengths, no settings, no text — and you can click one and read it. The privacy page lists all five events by name, and describes the feedback form, which is the one place in the product that deliberately transmits something you typed.

Your own obligations

None of this decides the question for you. Whether you may paste a particular client's text into a particular tool is a matter of your professional obligations, your firm's policies and any confidentiality undertakings you have given — and an architecture that transmits nothing makes that easier to answer honestly rather than answering it on your behalf.

What it does mean is that you can answer it with a fact rather than an impression, which is a better position than the one most of these decisions get made from.