Security at Change Lens

Last updated: 19 September 2026

Change Lens reduces exposure by keeping the normal source-file comparison path in the browser and storing only what is needed for optional SaaS features.

Browser-first source processing

Normal document and image comparison runs client-side. Saved cloud reports are sanitized structured outputs rather than original uploaded files or complete extracted text.

Account security

Password stretching is performed with browser WebCrypto before the credential proof is submitted. The Worker stores a per-user salted HMAC verifier protected by a persistent server-side pepper; the plaintext password is not stored. Authentication uses random server-side sessions with Secure, HttpOnly, SameSite=Lax cookies and expiry. Account deletion removes account-linked cloud data through database cascades.

AI boundary

Standard AI questions receive structured comparison data. Clause wording is shared with AI only after an explicit one-time approval for that clause. The assistant is instructed not to imply that it has read material it did not receive.

Billing webhooks

When Dodo Payments is configured, webhook requests are verified using the Standard Webhooks signing pattern and the configured webhook secret. Webhook IDs are stored for idempotency.

Operational controls

The application applies request-size limits, assistant rate limits, plan usage limits, origin checks for state-changing browser API requests, and minimal cloud report retention. No security design eliminates all risk; important or highly confidential documents should still be handled according to your organization’s own policies.

Report a security concern

Use the contact form and include enough technical detail to reproduce the issue, without attaching confidential source documents.