Security and architecture

Last updated 30 October 2026 · for security and procurement reviews

Data flow

• The app is a static web page. Your Form 1042-S file (Publication 1187) or spreadsheet is opened with the browser's File API and converted by JavaScript in the tab.
• No request ever carries a recipient name, a TIN, an amount or a result. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check.
• The IRIS CSV files and the review workbook are created in memory and saved by your browser to your computer. The review workbook masks TINs. Closing the tab discards everything.

How to verify it yourself

• Open the app, let it load, switch off your network, convert your file and download the results: it still works.
• Open the browser's developer tools (Network tab) during a run: no request carries your file.
• Read the code: the engine is plain, unminified JavaScript under /core/ (p1187.js reads Publication 1187 records, iris.js applies the IRIS rules, convert.js builds the files) and /assets/app.js.

Engine checksums (30 October 2026)

SHA-256 of the files that read and convert your data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed teams can ask for this exact build as a ZIP to host on their own network.

• /core/p1187.js: 64778aad2a2065d92db4a983f2bd3c43be8a0cdd79935530d8d10d24148e8ec6
• /core/iris.js: ab3dec4666755473fee8027b41a830ef4a067a33bccc3698e9f2d8035ed0e5ce
• /core/iris-spec.js: bf4b8e776d18c2bec088e9079ded4ddf91ca7ad78f2e07bd4dfd76acfbb3b8f4
• /core/codes1042.js: c32ff038d026fa259a2959acf46e55c0db4462af626e4aeb975b3fb83fa176e8
• /core/convert.js: a54cf7e47d8b6dc7e2bfb19e533462117fe7954a9dd4155abbe8f5049406e73c
• /core/codes.js: 5557515d14cf4e9c7919692dc68ed4fb472e6169928ab4cc50c45b8263242670
• /core/xlsx-read.js: 20bec06f9d312a6b8ade08a493615bf720925a03c813a8d265330a419fb6ae6a
• /core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
• /core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
• /assets/app.js: 40023eacb7b5718fe9f489aca86e614682f7ed1d579e2d6fef455edb75ad738e

Browser hardening

• Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site and Paddle; framing blocked.
• No analytics, advertising or tracking cookies. Your license key is kept in the browser's local storage and verified offline with an Ed25519 signature.

Sub-processors

• Cloudflare: hosting of the static site and license endpoints (no recipient data).
• Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day. Purchase orders, Paddle's W-9 and a quote PDF: procurement page.