For IT, risk and procurement reviews

Security and architecture

Last updated 30 October 2026

Data flow

• The app is a static web page. Ledger and trial balance files are opened with the browser's File API and analysed by JavaScript in the tab.
• No request ever carries a ledger, a trial balance, a client name or a result. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, licence issue (Paddle transaction ID and checkout email) and a health check, plus an anonymous visit counter (an event name such as "sample opened" and the link's campaign tag; daily totals only, no IP address or file data stored).
• The workpaper (.xlsx) and CSV exports are built in memory and saved by your browser to your computer. Closing the tab discards everything. There is no client data processing, so there is no data processing agreement to sign and no new vendor holding client data.

How to verify it yourself

• Open the app, let it load, switch off your network, load a ledger and export the workpaper: it still works.
• Open the browser's developer tools (Network tab) during a run: no request carries your file.
• Read the code: the engine is plain, unminified JavaScript under /core/ (analyze.js applies the criteria, workpaper.js writes the workpaper) and /assets/app.js. The method page describes every rule.

Engine checksums (30 October 2026)

SHA-256 of the files that read and analyse your data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed firms can ask for this exact build as a ZIP to host on their own network.

• /core/analyze.js: e3242e5bdcec56e1c5d8b220ede2dda0ea25450bd1eaa0cd6d7463c7bc62af99
• /core/parse.js: d822c272fcd45dd7b9f1abad1dfaee696ac6ee182e77daeab34ab4d5d32c2f98
• /core/mapping.js: 4ade1a4637e0f4cbff4de2e4e13299da3bdd592a5c6ff9504d222794f87def6f
• /core/holidays.js: 0f517bc245553616695e7e3c4ff1a6e43c50b0ea98d89e69ede6a848ec32a8e0
• /core/session.js: 157365fff80d7ab32b9d45bc3893a6023910fb44894812ebc7cce9d995046a95
• /core/workpaper.js: 35c2501b2060c2081a1f5008a7ea1ca41d82813bcf76684b35557c3e5c31e8f6
• /core/xlsx-read.js: f7c0ea28b770c9919bbe10af1c4b2b584d7e4c23b478de0fb6bfff7e3063f488
• /core/xlsx-write.js: 15e161697185dffa8249d2681ac35804144e1558e3a18df0e4d3d82dd5bbb63b
• /core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
• /assets/app.js: 6c59ac8701c92727e893f0a7989b8fa4a7e49c49776e58c2a81b08b64b5c2e8c

Browser hardening

• Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site and Paddle; framing blocked.
• No analytics, advertising or tracking cookies. Your licence key is kept in the browser's local storage and verified offline with an Ed25519 signature.

Sub-processors

• Cloudflare: hosting of the static site and licence endpoints (no client data).
• Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: security questionnaires, supplier forms and quotes, answered within one business day.