Notice, 29 September 2026

Before 29 September 2026, the app's activity log could be opened by anyone who knew its address. That log listed the links to documents generated in the previous seven days, so those documents could have been opened by someone other than the person who generated them. Uploaded files were never stored, so no configuration file was exposed, only the generated documents. The app keeps no record of who reads what, so we cannot tell whether anyone did.

It is fixed: the log is no longer served, every link created before the fix has stopped working, and those documents have been deleted. If you generated a document before that date from a real network, treat its contents as possibly seen.

The short version

• Uploaded files are never stored. Secrets are removed from them in memory, before they are written anywhere, and the files are deleted when your document is built. Neighbour-table captures and GPU fabric specs are read in memory and never written at all.
• Generated documents are kept for 24 hours, then deleted automatically. You can delete yours sooner with the Delete button next to it.
• There is no database, no account, no cookie and no third-party analytics. Logs record what happened, never what you uploaded. Visits are counted per day without identifying anyone (see the table below).
• For a sensitive network, run netlld on your own machine. The command-line tool is the same pipeline, and nothing leaves your network.

What is stored, where, and for how long

Data	Stored?	How long
Files you upload or paste	Only in a temporary folder for the length of the request, with secrets already removed	Deleted when the build finishes
LLDP/CDP captures and GPU fabric specs (the Topology map and GPU fabric tabs)	Never written. Read in memory; only what the parsers pick out - device names, ports, platforms, the spec's values - reaches the generated report	Gone when the request ends
Your generated documents, diagrams and configuration downloads	On the app's storage volume, under a random 128-bit link	24 hours, or until you press Delete
Activity log	Time, run ID, device count, duration, and a one-way hash of the fabric name - not the name itself	Last 500 entries
Error log	Error type and the code location, not the message (which could quote your input)	Last 500 entries
Your IP address	Not stored. The rate limiter keeps a salted hash in memory only, with a salt that is never written down	Until the app restarts
Visit counts	To count visitors, each page view, build and download is logged with a one-way hash of your IP address, keyed with a random salt that belongs to the current UTC day. No address, cookie or browser fingerprint is kept	Until the end of the UTC day. The hashes and that day's salt are then deleted together, leaving only the day's totals
A NetBox URL and token, if you give one	Used for your one build, in memory	Discarded when the build finishes

Secrets are removed before anything reads your files

Before a file is parsed or written to disk, every value that looks like a secret is replaced: user and enable passwords, SNMP communities and v3 keys, TACACS+ and RADIUS keys, BGP, OSPF, IS-IS and NTP authentication keys, SSH keys, and private keys and certificates. For AVD YAML, any value under a key named like a secret (password, key, secret, communities…) is replaced. The design itself does not use secrets, so the document is the same either way. The test suite proves both: planted secrets never reach any generated file, and a redacted config produces the same fabric as the original.

This is a safety net, not a reason to skip your own checks. Strip anything you would not want to share before uploading.

Who can open a generated document

Anyone holding its link, until it is deleted. The link contains 128 random bits, so it cannot be guessed, but it can be forwarded, so treat it like a shared file. Document pages tell browsers not to cache them or send them as a referrer, and tell search engines not to index them.

Where it runs

Provider	Role	Location
Fly.io	Hosting and the storage volume for generated documents	United States (Ashburn, Virginia)

The optional AI prose rewrite is turned off on this deployment, so no part of your design is sent to any AI provider.

Your NetBox, if you connect one, is contacted directly from the app, over https only, and only to read the switches in your upload. The app refuses NetBox addresses on private networks.

Deleting your data

Press Delete this document now in the results panel. The document, its diagrams and every download are removed from the server immediately. Only the browser that generated the document holds the key to delete it; everything else is removed automatically after 24 hours.

netlld is a preview with no service agreement. It is not certified under SOC 2 or ISO 27001. If your organisation needs either, or needs data kept in a specific region, use the command-line tool on your own infrastructure.