Why Local File Merging is Safer Than Cloud Tools

When you upload your company's sensitive spreadsheets to a random "free online tool", you are risking a data breach. Here is why processing files locally is the only secure way.

The Hidden Cost of "Free" Online Tools

Server-based merging tools take your Excel and CSV files, upload them to their own servers, process the merge, and send you a combined file. But what happens to the data left on their server?

• Data Retention: Even if they claim to delete files after 24 hours, backups can persist for months.
• Interception: Files sent over the internet can potentially be intercepted.
• Compliance: Uploading customer data often violates GDPR, HIPAA, or strict company policies.

The WebAssembly Advantage

With FileMerger, we use WebAssembly to run the processing engine directly inside your web browser. Your files are never uploaded to any cloud server. The merging happens using your computer's own memory and CPU.

What "Local Processing" Actually Means

The phrase is used loosely enough to be nearly meaningless in marketing copy, so it is worth being precise. In FileMerger, selecting a file gives the page a browser File handle, which is a reference to bytes on your own disk. The merging code reads through that handle, builds the combined result in your browser tab’s memory, and hands the result to the browser’s download mechanism. No network request carries the file content at any point in that chain.

This is different from services that describe processing as secure because it happens over TLS and the file is deleted afterwards. Both of those claims can be entirely true while the file still sits, decrypted, on someone else’s server for the duration of the job. Encryption in transit protects the file from third parties on the network; it does not protect it from the service operator. Deletion after processing depends on the operator doing what they said, on their backups expiring, and on no copy having been made in between.

How to Verify the Claim Yourself

You do not have to take our word for any of this, and you should not. Browsers ship with the tools to check it in under a minute:

1. Open the developer tools in your browser, usually with F12, and switch to the Network tab. Leave it open and recording.
2. Merge a file as you normally would, then look at the requests that were made. Sort by size if the list is long.
3. Confirm that no request carries a payload anywhere near the size of your file. You will see requests for scripts, fonts and advertising, and nothing containing your data.

For extra certainty, disconnect from the network entirely after the page has loaded and then perform a merge. It will complete normally, because nothing it needs is on a server. That test is difficult to fake and worth running once against any tool that makes this claim, including ours.

The Threat Model This Does and Does Not Address

Local processing eliminates a specific and significant set of risks: interception in transit, retention on a third-party server, exposure through that party’s breach, access by their staff or subprocessors, and cross-border transfer of data you are not permitted to transfer. For most people uploading a spreadsheet to a free web tool, those are the risks that actually matter, and they disappear entirely.

It does not make your device secure. If your machine is compromised, a browser-based tool offers no protection, because the attacker already has the file. It does not protect against you downloading the merged output to a synced folder that replicates it somewhere you did not intend. And it does not remove your obligation to handle the data correctly once merged. Local processing narrows the attack surface to your own machine; it does not eliminate it.

GDPR, CCPA and the Processor Question

Under GDPR, a service that receives personal data on your behalf is a processor, and using one requires a data processing agreement, a record in your processing register, and due diligence on the vendor. This is the administrative burden that makes most compliance teams refuse ad-hoc online tools, and they are right to. A free file converter that receives customer records is a processor whether or not anyone filled in the paperwork.

When processing genuinely happens in the browser, no personal data is transmitted to the tool operator, so there is normally no processor relationship to document. The same reasoning applies to CCPA, where no sale or sharing of personal information occurs because no personal information changes hands. This is not legal advice and your own counsel should confirm it for your circumstances, but it is the reason browser-based tooling tends to clear internal review far more easily than a server-based equivalent.

A Practical Checklist Before You Merge Sensitive Data

Regardless of which tool you use, a few habits prevent most of the incidents that actually happen with spreadsheet work:

• Check where the merged file lands. A downloads folder that syncs to a personal cloud account moves the data somewhere your policy probably does not cover.
• Remove columns you do not need before merging rather than after. Data you never combined cannot leak from the combined file.
• Watch for hidden columns and filtered rows in Excel sources. They are included in a merge even when they are not visible on screen, which surprises people regularly.
• Be careful with browser extensions when handling sensitive files. An extension with permission to read page content can see data the page is working with, whatever the page itself does.

None of these are exotic. They are the ordinary failure modes of handling data in spreadsheets, and they cause considerably more real incidents than the sophisticated attacks that get more attention. Getting the boring parts right is most of the work.