Data processing guide

• After you click Decode, Apply schema, Deserialize, or Serialize, the relevant input is sent through the Topcoat runtime for server-side processing and result rendering. Submission happens only after an action; typing a draft does not submit it automatically.
• The application has no accounts, history, team workspace, or server-side file storage. The application code does not write payloads, schemas, JSON, or decoded results to persistent storage.
• Request bodies exist in server runtime memory while being processed. That does not guarantee that a deployment has no logs or backups, so also review the deployment logging boundary below.

The application must not log message contents. Operators must still inspect the Rust process, reverse proxy, CDN/WAF, error reporting, tracing, and analytics services, and disable request-body, form-signal, and debug-output capture.

Do not log or transmit: raw request bodies, .proto source, JSON contents, decoded field values, hexdumps, hex/base64 output, clipboard contents, or query parameters containing user input.

Operational metrics should use only low-cardinality metadata such as status, duration, request-size buckets, and controlled error categories; operators must define retention and access permissions in their logging policy.

Review the deployment scope on this page

• Do not submit API keys, access tokens, passwords, private keys, cookies, PII, customer data, or unsanitized production traffic.
• Before submitting, replace identifiers, domains, email addresses, tokens, and business fields; confirm that the payload and schema comply with your organization's handling policy.
• If data must not be sent to a third-party service, run the tool locally or deploy it yourself instead of relying on assumptions about a public instance.

Local execution does not change the server-rendered model, but it keeps data inside an environment you control. Production deployments should use HTTPS, a reverse proxy, and logging configured not to record request bodies.

cargo run

# Listen on all interfaces with an explicit port
HOST=0.0.0.0 PORT=8080 cargo run

For a public deployment, also set GRPC_TOOLSET_PUBLIC_URL; see the README for complete runtime and container guidance.