Your logs never leave this browser.

What runs where

Everything LogForge does — reading the lines you paste, detecting fields, generating parser configs for a dozen SIEM and log-shipper formats (regex, Grok, Wazuh, Splunk, Elasticsearch, Datadog, Vector and more) — happens as JavaScript inside your own browser. There is no parsing server. When you paste a log line, no request carrying that line is sent anywhere.

You don't have to take our word for it: open your browser's developer tools, switch to the Network tab, and use the tool. You will see zero requests containing your log content. The only traffic is the page itself, its fonts and scripts, and a single tiny analytics ping described below.

LogScrub — masking runs here too

LogScrub detects and masks sensitive values — IPs, emails, hostnames, tokens, secrets — entirely in your browser, the same way LogForge parses. Nothing you paste is uploaded. The original→replacement mapping (the table that could turn a scrubbed log back into the real one) is the most sensitive part, and it never leaves this browser: it is held in memory, shown only to you, and only written to the mapping CSV you choose to download. The persistent pseudonym dictionary offered with Pro is stored in this browser's localStorage and is never transmitted. When you close the tab, everything you pasted and every mapping is gone.

What we don't store

There are no accounts and no cookies, and nothing is written to storage unless you ask for it. The one exception is opt-in and stays on your machine: if you explicitly name and save a parser in LogForge, its configuration — the sample lines you pasted, your field renames/type overrides, and the active output tab — is written to this browser's localStorage (free tier: up to 3, each deletable) so it survives a reload. Nothing else you paste is stored anywhere, and none of it is ever transmitted. Delete the saved parsers (or use a tool without the save feature) and closing the tab leaves nothing behind.

What we do collect

Basic page analytics via a self-hosted, cookieless Umami instance running on our own hardware: which page was viewed, the referrer, and a coarse browser/device class. We also record a few anonymous interaction counts — for example which output format you copied (the tab name only — Regex, Grok, Splunk, Datadog, and so on), or that a built-in sample was loaded — so we know which formats to improve. These events carry only that short label and a count. Analytics never sees your log content, field names, field values, or generated output, and no data is shared with or sold to anyone — there are no third-party trackers and no ads.

Hosting and fonts

The site is served from our own machine, fronted by Cloudflare's network. Like any web server, ours keeps ordinary access logs (requested URL, timestamp, IP address) for a short time to keep the service running and debug problems — these are standard page requests and can never contain anything you paste into the tool. Fonts are self-hosted and served from the same place as the page, so no font provider sees your visit either.

The future paid tier

If we ship an optional AI-assist feature later, it will be strictly opt-in per request: data is only sent when you explicitly press the button that says so, and the free tool will keep working fully offline-in-the-browser either way.

The Pro "Ask AI" feature

Pro adds an optional "Ask AI to map fields" button. It is the only part of LogForge that sends log content anywhere, and only when you explicitly press it: at that moment the lines you submitted and the current field names/types are sent to our own server and on to Anthropic to suggest better names and types. Everything else — detection, generation, copying, bulk ZIP, shareable links — still runs entirely in your browser. Validating a license key sends only the key itself to Lemon Squeezy; it carries none of your log data. See the pricing page for what Pro includes.

Questions

Email [email protected] — happy to explain anything here in more detail.