Privacy and Security

This page consolidates information about how MIDAS handles data processing, storage, external communication, encryption, and licensing.

Data Processing

All data processing — CSV import, statistics computation, graph rendering, regression modeling — runs entirely within your browser. No server receives the files you load, your analysis results, or your project data, and none of it leaves your device over the network. The only data MIDAS sends out on its own is the set of events listed under Usage telemetry, and those events contain none of your data.

Data Storage

Location	Purpose	Persistence
OPFS (Origin Private File System)	Project file storage	Cleared with browser site data
IndexedDB	Signing key storage	Cleared with browser site data
localStorage	Application settings	Cleared with browser site data
User's file system	Exported MDS files	Managed by the user

OPFS¹, IndexedDB², and localStorage are browser storage APIs. Data is scoped to the app.midas-app.org origin and cannot be accessed by other sites or browser profiles. If multiple people share the same browser profile, they can all access the stored data. Use separate OS user accounts or separate browser profiles on shared workstations.

MIDAS does not encrypt stored data at rest. If disk-level data protection is required, use OS-level disk encryption such as BitLocker or FileVault. OPFS and IndexedDB data is stored inside the browser's profile directory, so it is covered by full-disk encryption.

External Communication

CSP restrictions

The app (app.midas-app.org) has no third-party analytics or tracking scripts. CSP³ script-src allows only scripts served from the app's own origin. As an exception, Cloudflare, which delivers the app, may inject a bot-detection script (JavaScript Detections); when it does, a nonce permitting that script is added to the CSP. Files and project data loaded by users are never sent externally.

CSP connect-src allows HTTPS connections for the Open from URL feature, which fetches files from user-specified URLs. Enable "Block connections to untrusted domains" in Settings under Trusted URLs to dynamically restrict connect-src to only trusted URL domains. CSP policies can only be made stricter, never relaxed, so the restriction cannot be tampered with by JavaScript.

The DuckDB worker has its own, stricter CSP served via response header: connect-src is limited to MIDAS's own origin and the extension distribution host operated by the DuckDB project (extensions.duckdb.org) only. This is independent of the main-thread settings, so code running inside the worker cannot reach any other host regardless of the Trusted URLs configuration. As a second layer, MIDAS disables DuckDB's automatic extension installation and loading at startup so that the httpfs extension is never loaded, which prevents read_csv('https://...') from resolving external URLs even if the CSP layer were bypassed.

Usage telemetry

The CSP restrictions above prevent unintended outbound communication. Separately, MIDAS itself sends the following events to Cloudflare Workers Analytics Engine for feature improvement:

Launcher view shown
Project view shown
Unhandled JavaScript error (including a token indicating the error type, e.g., TypeError, RangeError)

Each event is accompanied by the application version, the originating country/region, and the User-Agent string. The country/region and User-Agent are not sent from the client; they are read by the Cloudflare Worker from the incoming request.

Data contents, file names, column names, names of features used, error message bodies, stack traces, and session IDs are not sent. Individual usage sequences cannot be reconstructed.

Documentation site analytics

The documentation site (midas-app.org) uses Cloudflare Web Analytics for access analysis. It collects page views, referrer URLs, country/region, device type, browser type, and access timestamps. No cookies are used.

Delivery infrastructure

Both the app and documentation site are delivered through Cloudflare's infrastructure. Cloudflare processes and retains request information, including IP addresses, as part of this process. The Provider accesses this information only when necessary for security purposes and does not use it for behavioral tracking or profiling. See the Privacy Policy for details.

Digital Signatures

Exported MDS files are always digitally signed. The first time you export, entering a signer name creates your signing key. Saving inside the browser does not sign anything.

Algorithm: ECDSA P-256 + SHA-256
Implementation: Browser's Web Crypto API⁴
Key storage: Signing key pairs are stored in IndexedDB. Keys are never transmitted outside the browser

Signatures let you confirm who created a file and also detect tampering after signing. Signatures do not encrypt the file's contents. Signer names are self-declared; verify a key's owner by comparing fingerprints out-of-band. There is no PKI or certificate authority integration; the trust model resembles PGP's Web of Trust.

Signing keys can be backed up and restored as password-protected files. The backup file is encrypted with AES-256-GCM, and the encryption key is derived from the password with PBKDF2 (SHA-256, 100,000 iterations). See MDS Files and Managing Signing Keys for details.

Signature badge and trust levels

When you open an MDS file, a badge in the top-right of the menu bar shows the trust level of the project. The level is determined from the file's provenance — everyone who created it or edited and re-exported it — and the badge shows the lowest level among them:

Official (green) - Signed with a key that ships with MIDAS. The label reads "Official".
Trusted (blue) - Signed with a key you have registered in your trusted list. The label is the name you gave the key when you registered it.
Unknown (yellow) - The provenance includes a key that is neither official nor in your trusted list. The label reads "Unknown".

Projects created in this browser have no signature and no provenance, so no badge is shown. Once you edit and save an opened project, the label gains "(modified)" to indicate the contents no longer match the signed file.

Click the badge to see the full fingerprint, the signer name, the time the file was signed, and the verification status. The signer name is the official display name for Official, the name you assigned at registration for Trusted, and the self-reported name (marked "self-reported, unverified") for Unknown. If the provenance includes multiple signers, all of them are listed in the Provenance section. Unknown signers can be registered from the popover; files from that key are treated as trusted from then on.

Opening files with unknown signatures

By default MIDAS opens MDS files with unknown signatures without a confirmation dialog. The badge shows the unknown status, and you can verify the fingerprint before trusting the signer.

Opening without a dialog is safe because code paths that unknown-signed files could previously use to reach external servers (for example, DuckDB extension auto-load) are now blocked at load time regardless of trust level. Even a hostile MDS file cannot trigger outbound network requests through the normal analysis flow. In addition, Data Table link display is disabled in projects with unknown provenance, preventing attacks that lure you into opening links planted in the file. This restriction persists even after you edit and re-save the project.

If you regularly open MDS files from untrusted sources and prefer an explicit confirmation for every unknown signature, open Help > Settings... and enable Require confirmation for unknown signers on the Security tab. With that setting on, MIDAS shows a confirmation dialog each time. The dialog offers Cancel, Trust this signer and open, and Open Anyway. Choosing Trust this signer and open prompts you for a name, registers the key as trusted, and opens the file in the same flow.

Key design decisions

Signing key pairs are generated in the browser with the Web Crypto API extractable flag set to true. This setting is required for key export and backup. An alternative design — importing externally generated keys — would allow extractable: false, but would require users to manage key pairs with tools like OpenSSL, adding significant operational burden.

Because keys are extractable, any JavaScript executing on the same origin (e.g., via XSS) could read the private key. This risk is mitigated by CSP script-src restrictions that limit which scripts can execute.

If a private key is compromised, generate a new key pair and redistribute the new public key to your peers. There is currently no centralized key management or revocation mechanism.

Data Deletion

MIDAS data is stored as browser site data. To delete it, clear the site data for app.midas-app.org in your browser settings. This removes all saved projects, signing keys, and trusted public keys.

To delete individual projects or check storage usage, use the Storage Management screen.

Exported MDS files reside on the user's file system and must be deleted separately.

Deployment Model

MIDAS is a static-file SPA served from app.midas-app.org.

The Terms of Service prohibit copying and redistributing the software, so on-premises deployment is not available
There is no user authentication or access control
There are no organization management features

Install as a PWA to use MIDAS offline after the first visit.

License and Commercial Use

MIDAS is free to use, including for commercial purposes. It is currently in beta, so features may change without notice and there is no warranty on the accuracy or completeness of analysis results. For details on computational accuracy verification, see Numerical Accuracy. See the Terms of Service and Privacy Policy for full details.

MIDAS incorporates third-party open source software and bundles sample datasets. The license for each bundled library and for each sample dataset created by a third party is listed on the Third-Party Licenses page. The licenses for the synthetic datasets created by MIDAS are given in Sample Datasets.

Browser Requirements

MIDAS depends on the following browser APIs:

WebAssembly⁵: SQL execution via DuckDB
OPFS (Origin Private File System): Project data storage
IndexedDB: Signing key storage
Web Crypto API: Digital signature generation and verification
Service Worker⁶: Offline support (PWA)

The latest versions of Chrome, Edge, Firefox, and Safari are supported. Internet Explorer is not supported.

Verification happens in two ways. One is automated tests covering Chromium (Chrome / Edge) on Linux and Windows. The other is the developer's daily use of MIDAS on macOS with Firefox.