Is my IFC file uploaded anywhere?

No. Files are parsed entirely in your browser via web-ifc, a WebAssembly build of the open-source IFC parser. Nothing leaves your machine. The app works completely offline once loaded.

Can I use it with confidential models under NDA?

Yes. Because all processing happens in your browser and no data is ever transmitted to any server, you can safely use it with confidential project models under NDA. There is no service agreement to review with your client — no data changes hands.

Can I share the validation results with my team or client?

Yes. After running validation, click Share Report to copy a link that encodes the full Health Score and issue list directly in the URL — no file upload, no server, no account required. You can also export results as JSON, CSV, or a Validation Certificate. The IFC file itself never leaves your browser.

Yes, fully. IFC Viewer Online works on any modern browser — Chrome, Edge, Firefox, and Safari on both Mac and Windows. No plugin, no installation, no operating system restriction.

What happens if my IFC file is very large?

The app handles files up to 2 GB. Performance depends on your device — files under 200 MB load well on most modern hardware. Once parsed, geometry is cached in OPFS so every subsequent load of the same file is instant, even offline.

How does the validation work?

The validator runs 44 built-in rules in a background Web Worker so the UI stays responsive. Rules cover GUID duplicates, spatial hierarchy, orphan elements, naming conventions, missing type assignments, ISO 19650 property sets, LOD completeness, clash detection, proxy overuse, coordinate offset, storey-elevation integrity, unit consistency, and more. You can also run a buildingSMART IDS specification against the model. Every model receives a Health Score from 0 to 100. Results stream in as each rule completes.

Can I fix errors and re-export a corrected IFC?

Yes. All edits (GUID fixes, renames, property value changes) are held as non-destructive diffs with full undo/redo. Clicking Export IFC applies all diffs to the original binary in a Web Worker and downloads the corrected file — no server involved.

What IFC versions are supported?

IFC2x3, IFC4, IFC4x1, and IFC4x3. The viewer uses the open-source web-ifc parser — the same engine used by most modern BIM tools and @thatopen/components. Outdated schemas are automatically flagged by the validator.

What measurement tools are available?

You can measure lengths between any two points, areas of surfaces, volumes of enclosed elements, and individual edge lengths — all directly in the 3D viewport. Measurements persist as labelled annotations and can be exported alongside your model.

Can I load multiple IFC files at once?

Yes. Load as many IFC files as your device memory allows. Each model has independent visibility, transforms, validation, quantity takeoff, and export. Use the Scene panel to manage, reorder, or remove models at any time.

Does it work offline?

Yes, once the page is loaded. The WebAssembly parser and WebGL renderer run entirely in the browser. Parsed geometry is cached in OPFS so repeat loads are instant even without a network connection.

What are the file size limits?

There is no enforced limit — performance depends on your device. Files up to ~200 MB typically load well on modern hardware. The OPFS geometry cache means you only pay the parse cost once per file.

Is it free? Can I use it for commercial projects?

Yes, completely free. The source code is MIT-licensed. You can use the live app or fork the repository for your own projects, including commercial ones.

Back to the BIM & IFC blog

Best Practices · 2026-06-04 · 8 min

The BIM Tool IT Security Checklist: 10 Questions Your IT Department Will Ask

IT won't approve a new tool just because it's useful. They'll ask about data residency, encryption, GDPR, sub-processors, and source auditability. Here are the 10 standard questions — and exactly how IFC Viewer Online answers each one.

The BIM Tool IT Security Checklist: 10 Questions Your IT Department Will Ask — IFC Viewer Online article cover

BIM tools have to survive IT approval. In large AEC firms and public sector organisations, any browser-based tool that handles project data goes through a security review — sometimes a formal DPIA, sometimes an email thread with the IT security lead. Either way, you need documented answers before the conversation starts.

This is the plain-English security record for IFC Viewer Online. Send this page to your IT department directly, or use it as a baseline to evaluate any BIM tool you're considering.

10 — security questions answered
0 — servers store your model data
100% — open-source and auditable
0 — user accounts or credentials

1. Where is project data stored?

IFC model data is never stored on any server. All parsing, 3D rendering, and validation run in your browser via WebAssembly. The only 'storage' is your browser's Origin Private File System (OPFS) — a sandboxed local area on your own device that no website or server can access. When you close the tab, the data stays on your machine.

2. Does the tool transmit model data over the internet?

No. The IFC file is opened by browser File APIs and passed directly to the WebAssembly parser. No XHR or Fetch requests carry model data. Verify this in your browser's DevTools Network tab: filter for XHR/Fetch while loading a file and you will see zero outbound requests for model content.

3. What data does the tool collect?

Anonymous usage events via PostHog: 'file opened', 'validation ran', 'export clicked'. No model content, no filenames, no property values.
Email address — only if the user voluntarily submits the subscription form.
Validation issue summary — only if the user explicitly clicks Share Report.

4. Is the tool GDPR compliant?

Yes. Model data never reaches any server, so there is no data processing relationship under GDPR for model content. Analytics run in cookieless (memory-only) mode — no tracking cookies set. Email collected only with explicit consent. Full Privacy Policy published and maintained.

5. Who are the sub-processors?

PostHog — anonymous product analytics. US-hosted.
Resend — email delivery. Only for users who subscribe.
Cloudflare — shared-report rendering function. Processes only issue summaries explicitly shared by the user.
GitHub Pages — static site hosting. Serves HTML, CSS, and JavaScript assets only.

None of these sub-processors receive IFC model data.

6. What encryption is used?

All communication uses TLS (HTTPS). Model data is never transmitted, so in-transit encryption for model content is not applicable. Local OPFS storage is managed by the browser and subject to the operating system's own disk encryption (BitLocker on Windows, FileVault on macOS).

7. Does the tool require user accounts or credentials?

No. IFC Viewer Online has no authentication system, no user accounts, and no passwords. Users access it via URL with no login. This eliminates credential management risk and means there is no central user database to breach.

8. Can we use it on a public sector or defence project?

For standard commercial confidentiality and NDA-governed projects, yes. Model data never leaves the device. For projects with classified data handling requirements (UK Official or above, ITAR/NIST-governed), assess whether the browser environment itself meets your classification baseline — as you would for any browser-based tool.

9. Is the source code auditable?

Yes. The full source code is MIT-licensed and publicly available at github.com/j03rul4nd/ifc-viewer-online. Your security team can review the codebase, confirm the absence of data exfiltration code, and fork it for internal deployment if required.

10. What is the data retention policy?

IFC model data: not retained — never received.
Analytics events: retained by PostHog per their standard data retention policy.
Email addresses: until the user unsubscribes or requests deletion.
Shared validation report links: expire after 90 days.
Local OPFS cache: controlled by the user; cleared when browser storage is cleared.

IFC Viewer Online

Model data: 0 bytes transmitted to any server
No user accounts — zero credential risk
Data residency: on the user's own device
GDPR: cookieless, legitimate interest
Source code: MIT open-source, fully auditable
4 sub-processors, none handle model data
Works offline — no persistent server dependency

Typical cloud BIM viewer

Model uploaded and stored on vendor servers
Account required — credentials to manage
Data residency: vendor data centres
GDPR: DPA required, cookie consent UI needed
Closed source — no independent audit possible
Many sub-processors (cloud infra, CDN, analytics)
Outage risk if vendor's servers are unavailable

A Note for Security Teams

IFC Viewer Online is a static web application with no backend API, no database, and no server-side model processing. The primary risk surface is the browser runtime and the JavaScript/WebAssembly code delivered over HTTPS from GitHub Pages. For formal DPIAs or vendor assessment questionnaires, the Privacy Policy, the MIT-licensed source code, and this document should be sufficient for standard commercial security reviews.

The BIM Tool IT Security Checklist: 10 Questions Your IT Department Will Ask