Oomph Labs
Our Products
Technical Philosophy

Engineering at Oomph Labs

We believe durable software is built on rigorous constraints: small footprints, explicit data boundaries, deterministic testing, and transparent security controls.

Architectural Principles

Modern software frequently suffers from excessive dependencies, uncontrolled remote telemetry, and unnecessary server roundtrips. At Oomph Labs, our engineering philosophy inverts this pattern:

  • Local-First by Default: Perform computation directly inside the user's browser sandbox (via WebAssembly or modern JavaScript) whenever technically viable.
  • Minimal Attack Surface: If sensitive data never leaves the client, it cannot be leaked from a server-side database breach.
  • Strict Type Safety: All production codebases use strict TypeScript, eliminating entire classes of runtime errors before release.
  • Self-Contained Runtimes: Minimize reliance on brittle microservice meshes for operations that can run reliably client-side.

The Client-First Processing Model

Our flagship data application, CleanSheet, demonstrates how complex data workflows can run purely client-side. Using streaming CSV parsers and WebAssembly data transformations, multi-megabyte datasets are parsed, validated, and exported with sub-second latency.

Zero Server-Side Retention

When users import spreadsheets or documents into our client tools, our hosting servers never see, store, or log the document contents. The document lives solely in browser memory for the duration of the session.

Test-Driven Quality Gates

Reliability is not an afterthought. We implement comprehensive testing layers across all our software assets:

  • Unit Testing: Core algorithms—such as schema parsers, type validators, and redaction engines—are isolated into pure functions and exercised with Vitest/Pytest suites.
  • Boundary Condition Coverage: Test fixtures explicitly target malformed CSVs, unclosed delimiters, nested JSON edge cases, and unexpected unicode characters.
  • Continuous Validation: Automated CI pipelines verify static typing, lint rules, and test suites prior to branch merging.

Security Posture & Transparency

We maintain an honest, evidence-based security posture:

  • No Inflated Security Claims: We do not market unverified enterprise certifications or theoretical guarantees. We document our exact technical threat models openly.
  • Dependency Hygiene: Automated vulnerability audits on package dependencies and strict pinning of critical build actions.
  • Credential Segregation: Source control is monitored to prevent credential leaks, and secret API keys are never bundled into client-facing artifacts.

Public Repositories & Specifications

We believe in inspectable code. Our public software projects are hosted on GitHub:

Deployment Discipline

We favor static, immutable deployments hosted over global CDNs with HTTPS enforcement. By publishing static builds through verified GitHub Actions pipelines, we ensure that every deployed artifact corresponds to an exact, auditable Git commit SHA.