Security and architecture

Last updated 30 October 2026 · for security and procurement reviews

Data flow

• The app is a static web page. DROP lists and record exports are opened with the browser's File API and processed by JavaScript in the tab: standardization, SHA-256 hashing, matching and file building.
• No request ever carries file contents, identifiers or hashes. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, licence issue (Paddle transaction ID and checkout email) and a health check.
• Output files are created in memory and saved by your browser to your computer. Closing the tab discards everything.

How to verify it yourself

• Open the app, let it load, switch off your network, run your files and download the results: it still works.
• Open the browser's developer tools (Network tab) during a run: there are no requests.
• Read the code: the engine is plain, unminified JavaScript under /core/ (std.js, sha256.js, drop.js) and /assets/app.js.

Engine checksums (release 1.0.0, 30 October 2026)

SHA-256 of the files that read, hash and match your data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed teams can ask for this exact build as a ZIP to host on their own network.

• /core/std.js: b34878600cb1d9f254db2887e1a52897050ee051b3253240cd290b39ad1bb1cd
• /core/sha256.js: 68f64f427edb6ff363543d08c4b17b161ed55bf12c48db25ef00ad22952fb4af
• /core/drop.js: 31329ff0a155fd9a8998ebfe82e8bb9fa8e3dc13fa7d9de3dd4f31f0e566fc18
• /core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
• /core/zip.js: 91c705e59f21856f29e98041feff8c19368d8884411636e96efd3dad4c8eeed9
• /assets/app.js: e3a5bfdcd56b81ebe583b768d578e7210f11cea8d0545eba8f28e8770ba6cb74

Browser hardening

• Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site and Paddle; framing blocked.
• No analytics, advertising or tracking cookies. Your licence key is kept in the browser's local storage and verified offline with an Ed25519 signature: a licensed run makes no network call either.

Hashing correctness

• Standardization and hashing follow CalPrivacy's published DROP technical specification (read 30 October 2026).
• All 20 published test values are recomputed every time the app opens; the result is shown on screen and written to every audit log.

Sub-processors

• Cloudflare: hosting of the static site and licence endpoints (no consumer data).
• Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day.