Last updated: July 2026 Applies to: Free, Pro, and Teams plans (self-service) Maintained by: Iterating Inc. — [email protected]
This document answers the security and privacy questions that utilities and engineering firms most commonly ask about epanet-js. It is intended to help your team complete its own internal security review and vendor assessment forms for our self-service plans.
Scope note: This document describes epanet-js in its standard, local-first configuration, which is how all self-service plans operate. Cloud project sync is opt-in on a per-project basis and is currently available to a limited set of invited organizations; we work with those organizations directly on their security reviews. Organizations that want a hard guarantee can disable all cloud functionality across their accounts (see section 2). We will update this document when cloud workspaces become generally available. Enterprise configurations (customer-managed storage and on-premises deployment) include a completed security questionnaire as part of onboarding — contact [email protected].
If a question your organization needs answered is not covered here, email [email protected] or book a call at https://cal.com/epanet-js/.
Q: Who is the legal entity behind epanet-js? Iterating Inc., a Canadian provincial corporation (Ontario) with its registered office at 2967 Dundas St W #536, Toronto, Ontario, M6P 1Z2, Canada. Iterating Inc. owns and operates the domains epanetjs.com, masteringwater.com, and iterating.ca.
Q: Who is the primary security and privacy contact?[email protected] for security questions and vulnerability reports. [email protected] for privacy and data-subject requests.
Q: In which jurisdiction is the company established? Canada. Canada is recognized by the European Commission as providing an adequate level of data protection under GDPR.
Q: What is epanet-js? epanet-js is a browser-based hydraulic modeling application for water distribution networks, built on the open-source EPANET simulation engine compiled to WebAssembly.
Q: Is epanet-js a cloud application? Where is our data processed? In its standard configuration, epanet-js is a local-first application, not a cloud application. The browser acts as a secure runtime, much like a desktop operating system: when the app loads over HTTPS, the entire application — including the simulation engine — downloads to the browser cache and runs on the user's own CPU and memory inside the browser sandbox.
Hydraulic models, network layouts, simulation results, and any customer data embedded in them are created, computed, and saved entirely on the user's machine. This data is never uploaded to, transmitted through, or stored on Iterating Inc.'s servers.
Q: What data does leave the user's machine? Only account and product telemetry data (see sections 4 and 6): login credentials handled by our identity provider, payment details handled by our payment processor, and product usage analytics. Model files and their contents are never transmitted.
Q: Can the application work without an internet connection? Yes. An internet connection is required to load the application initially. Once loaded, the user can disconnect entirely and continue creating models, running simulations, and saving files. This can be verified directly by disconnecting from the network after the app loads.
Q: Where are project files stored? On the user's hard drive or network drive, as ordinary files — the same pattern as traditional desktop modeling packages (InfoWorks, WaterGEMS, InfoWater). Files are shared through your organization's existing channels (email, shared drives, portable media), so your current file-handling and security policies apply without modification. No new data pathways are introduced.
Q: Does the browser get access to the user's whole file system? No. epanet-js uses the browser's File System Access API. When a user opens a project, the browser presents the native system file picker, and the application receives read/write access only to the specific file or folder the user selects. It cannot see the rest of the hard drive, the operating system, or network shares.
Q: Do you offer cloud sync, and how does it affect this assessment? Cloud project sync exists as an opt-in, per-project feature and is currently in limited availability with a small number of invited organizations, whose security reviews we handle directly. For all other users, no cloud sync is in effect, and enabling it is not possible without our involvement. Projects that are not cloud-enabled remain 100% isolated on the user's machine.