Security overview

Last updated October 19, 2026

In one sentence: PipeHat is a static web page that decodes HL7 v2 messages entirely inside the user's browser. The page is technically blocked from sending data anywhere, and messages are never uploaded, stored or logged by us.

How it works

• PipeHat is static HTML, CSS and JavaScript served from pipehat.io over HTTPS (hosting and CDN: Vercel).
• There is no server-side processing of messages: no upload endpoint, no API that receives message content, and no database of messages.
• All parsing, decoding, validation, profiling, the sensitive-information check and de-identification run in the browser's JavaScript engine on the user's computer.
• There are no user accounts and no sign-in.

Why it can't send data

The app page (/app/) is served with a Content Security Policy that tells the browser to refuse every outbound channel:

default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
img-src 'self' data:; font-src 'none'; connect-src 'none'; form-action 'none';
frame-src 'none'; worker-src 'none'; object-src 'none'; base-uri 'none';
frame-ancestors 'none'

• connect-src 'none' blocks fetch, XMLHttpRequest, WebSockets and beacons.
• img-src 'self' data: blocks image-based exfiltration to other hosts; form-action 'none' blocks form submissions.
• script-src 'self' means only PipeHat's own scripts run: no third-party scripts, analytics or advertising.
• The core restrictions are also set inside the page itself, so they still apply when PipeHat runs from a local folder.

To verify: open the app, open the browser's developer tools on the Network tab, and decode a message. The only requests are for PipeHat's own files when the page loads; nothing is sent when messages are pasted or decoded. The response headers are visible on the same tab.

Data stored on the user's computer

• Messages are held only in the open tab's memory and are discarded when the tab closes. They're not written to browser storage, cookies or disk (unless the user chooses to download an export).
• Three small items are kept in the browser's local storage: the license key (if entered), sensitive-information check settings, and one display preference. No message content.
• No cookies are set by PipeHat.

Licensing

License keys are digitally signed (ECDSA P-256) and verified on the user's computer with a public key built into the app. There's no license server and nothing phones home, so PipeHat works on restricted networks and reports nothing about usage.

Other security headers

Domains to allow

• pipehat.io (and www.pipehat.io, which redirects to it) is all the app needs.
• Purchases and subscription management use Stripe (buy.stripe.com, billing.stripe.com). These open only when someone chooses to buy or manage a plan, and never receive message data.

Third parties

HIPAA

Because messages are processed only on the user's computer and are never transmitted to or stored by PipeHat, PipeHat doesn't create, receive, maintain or transmit protected health information on a customer's behalf. In our view a business associate agreement is therefore not required to use the app; please confirm with your compliance team. Users should still view PHI only on devices and in settings their organization's policies allow, and shouldn't email messages containing PHI to our support address (the built-in de-identifier can prepare safe examples).

Updates

Updates are published to pipehat.io; script and style files carry content hashes, so browsers always load a consistent version. The reference data comes from HL7 Terminology, the HL7 v2-to-FHIR Implementation Guide, the hl7apy project and CMS (ICD-10-CM/PCS); see notices.

Offline copy

Because PipeHat is static files, it also runs from a local folder with no internet connection. If your organization prefers that, contact us for an offline copy.

Contact

Security questions or a vendor questionnaire: pipehatsupport@gmail.com. See also our privacy policy and license terms.