DicomScrub

We cannot see your data. Here is how to check that yourself.

"We take privacy seriously" is not evidence. This page lists the mechanisms that make uploading impossible, and the exact steps an IT or security reviewer can follow to verify each one in under five minutes.

1. The browser is ordered to block every outgoing connection

Every page on this site is served with the following Content-Security-Policy header. Note connect-src 'none': the browser will refuse any fetch, XMLHttpRequest, WebSocket, beacon or EventSource from the page, regardless of what the JavaScript tries to do. form-action 'none' blocks form submissions. default-src 'none' blocks everything not explicitly listed.

Content-Security-Policy:
  default-src 'none';
  script-src 'self';
  style-src 'self';
  img-src 'self' data: blob:;
  font-src 'self';
  worker-src 'self' blob:;
  manifest-src 'self';
  connect-src 'none';
  form-action 'none';
  base-uri 'none';
  frame-ancestors 'none';
  object-src 'none'

Verify: open DevTools (F12) → Network tab → reload. Every request is to this domain and none happens after the page finishes loading. Then in the Console run fetch('https://example.com'): the browser reports a CSP violation. That refusal is enforced by Chrome/Firefox/Safari, not by our code.

2. It works with the network unplugged

DicomScrub is a Progressive Web App. After the first visit it is fully cached. Verify: load the page, switch on airplane mode (or DevTools → Network → Offline), then drop files and anonymize. Everything still works, because everything ever happened on your machine.

For locked-down environments you can also install it (browser menu → Install DicomScrub) and run it like a desktop app with no network at all, or host the static build on an internal server.

3. No third-party anything

4. The engine is open source and the build is reproducible

The de-identification engine (parser, PS3.15 rule table, UID mapper, pixel redaction) is published as source-available code under the PolyForm Noncommercial License 1.0.0 at github.com/maituduy/dicomscrub. The deployed site is built from a tagged commit with npm ci && npm run build. The commit hash of the live build is shown in the page footer of the app; you can rebuild the same commit and compare the output byte-for-byte.

5. Licensing never phones home

Pro licenses are Ed25519-signed tokens. The app holds only the public key and verifies the signature locally. Purchasing and activation happen on a separate domain (dicomscrub-keys.maituduy.workers.dev) that never receives any DICOM data; the app itself cannot contact it because of the CSP above.

6. What de-identification does and does not do

DicomScrub implements the DICOM PS3.15 Annex E Basic Application Level Confidentiality Profile plus the named options you select. Every attribute in Table E.1-1 is removed, emptied, replaced with a dummy value or re-mapped (UIDs) according to the profile. In addition: all private tags are removed by default, all UIDs not defined by the standard are re-mapped, and all dates are shifted when the modified-dates option is on.

It cannot, by itself, know about identity burned into pixels. Use the redaction tool for those images. It also cannot remove identity hidden in free-text fields you choose to keep (descriptions). Review the audit log. The tool is not a medical device and correctness of a de-identification workflow remains the operator's responsibility.

7. Reporting a security issue

Email security@dicomscrub.com. We publish fixes and credit reporters in the repository changelog.

Checklist for your security team