Is draw.io Desktop ever sending data to any servers (except for update checks)?

[anno1985]

There are several pages on drawio.com that explain how and when data is sent to servers, for different versions of the application:

Online editor

The online draw.io editor at app.diagrams.net is delivered via Cloudflare edge data centers and data transmitted outbound is directed via those same Cloudflare centers. The server endpoints are all located within AWS data centers. The features requiring server-side functionality are:

• Translation of vsd, vss, and vdx files to vsdx. draw.io understands vsdx natively in JavaScript on the client.
• Import of Gliffy files.
• Migration of EMF images embedded in vsd/vsdx files. EMF licensing means only the Windows operating system may manipulate these.
• Generation of PlantUML diagrams. PlantUML is written in Java.
• Generation of PDFs of diagrams.
• Collaborative editing by sending only deltas of changes to other editors.
• Wherever possible we use serverless (AWS Lambda) functionality to reduce the attack surface of the endpoints.

draw.io server endpoints are all in the EU (in Frankfurt, Germany).

Data transmission lockdown

Additionally, you can use the lockdown toggle in the editor configuration to disable data transmission apart from directly between your browser where you are editing your diagram, and the cloud platform or location you have chosen to store the diagram file.

• https://www.drawio.com/blog/data-governance-lockdown

Confluence Cloud and Jira Cloud plugins

The draw.io apps for Confluence Cloud and Jira Cloud are both static plugins. That means they are delivered as complete web applications to the users’ browser and work without needing to contact our servers.
There are a couple of cases where data is sent to our *.diagrams.net servers to perform functions where the client browser is not capable of the operation, as detailed below. In these cases the operation is performed, the result returned and both the input and output are not persisted in any way.
These functions include:

• Export to PDF
• Import a .vsd, .vdx, .vssx or .gliffy file

Tip: If you want to disable all communication except between the user’s browser and the location where it is stored in your Atlassian product, set lockdown to true.

• https://www.drawio.com/doc/faq/data-flow-confluence-jira-cloud

Confluence DC/Server plugin

On Confluence Server/DC, in the default setup, no diagram data is ever sent externally under any conditions. [...]

We do not use web beacons, and we don’t profile you by your browser fingerprint. Your diagram data and your personal data is safe with draw.io.

• https://drawio-app.com/blog/drawio-data-protection

Desktop app

https://github.com/jgraph/drawio-desktop?tab=readme-ov-file#security states:

draw.io Desktop is designed to be completely isolated from the Internet, apart from the update process. This checks github.com at startup for a newer version and downloads it from an AWS S3 bucket owned by Github. All JavaScript files are self-contained, the Content Security Policy forbids running remotely loaded JavaScript.

No diagram data is ever sent externally, nor do we send any analytics about app usage externally. This means certain functionality for which we do not have a JavaScript implementation do not work in the Desktop build, namely .vsd and Gliffy import.

However, PDF export works (even though that needs server support in other versions). So I'm a bit concerned: Is that calling any servers in the Desktop app?

Is there any functionality in the Deskop app that calls servers (except for the update functionality)?

Does the app respect the lockdown config property?

[davidjgraph]

The desktop app doesn't have the lockdown config read as it already meets the conditions for lockdown, having no external comms.

The PDF export in desktop uses local print to PDF.

You could have just disabled your network connection and tested this.