Security

The model: nothing to breach

Every file you process, in every tool on this site, is processed inside your browser. Check registers, payment lists, account numbers, and generated files are never transmitted to our servers, never logged, and never stored. There is no user database, no account system, and no password to steal. A breach of our infrastructure would expose web page templates, because that is all our infrastructure holds. We could not produce your financial data in response to a subpoena, a breach, or a purchase offer, because we never have it.

What our servers do handle

Three narrow things. Static pages, served by Cloudflare. Pro license issuance: after a Stripe payment, your browser sends the Stripe checkout session id to our activation endpoint, which verifies it with Stripe and returns a signed license. Nothing is stored. Kit delivery: the same verification pattern serves the purchased download. Both endpoints hold API credentials that can read payment status at Stripe and nothing else: they cannot charge, refund, or read card numbers.

Payments

Checkout runs entirely on Stripe's PCI-DSS certified pages. Card numbers go to Stripe, not to us.

Licenses

Pro licenses are Ed25519-signed tokens verified in your browser against a public key shipped with the site. There is nothing to phish: a license cannot log in anywhere, contains no personal data, and is worthless off your machine.

Third-party code

Pages load no advertising scripts, no tracking pixels, and no third-party JavaScript beyond Cloudflare Web Analytics, a cookie-less page-view counter that never sees file contents. Where pages link to other companies, they are plain links. The privacy policy is the complete inventory.

Reporting a vulnerability

Email [email protected] with "security" in the subject. We read every report, respond within 2 business days, and credit reporters who want credit. Please do not test against other users' data; by design, there is none to test against.

Honest scope note: we are a small software company, not a bank, and we do not claim certifications we do not hold. This page describes the architecture as shipped; the Terms of Service govern.