Use this guide as an operational checklist, then run the linked tools to validate changes immediately.

Internal deployment

Self-host byteflow.tools

Teams can deploy byteflow.tools as a static app while keeping the product promise intact: no account, no cloud history, no server-side tool payload processing, and browser-local behavior by default.

Repository Privacy and Trust Center

Deployment checklist

Serve the static export from an internal static host, CDN, or object storage bucket.
Keep analytics disabled unless the provider and taxonomy are privacy-safe and aggregate only.
Apply the documented CSP, Permissions-Policy, Referrer-Policy, COOP, and CORP headers.
Do not add accounts, cloud history, server-side payload processing, or default payload persistence.
Cache only versioned app shell files, icons, static assets, and tool chunks.

Cache behavior

The PWA may cache the app shell and tool chunks. Tool input, output, uploaded file content, external-request responses, secrets, and generated content must not be cached by default.

Commercial boundary

Future support can focus on sponsorship, packaging, internal deployment help, or security review. It should not depend on collecting tool payloads, forced accounts, or hosted history.