Security and architecture

Last updated 30 October 2026 · for security and procurement reviews

Data flow

• The app is a static web page. Your FIRE file (Publication 1220) or spreadsheet is opened with the browser's File API and converted by JavaScript in the tab.
• No request ever carries a payee name, a TIN, an amount or a result. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check, plus an anonymous visit counter (an event name such as "sample opened" and the link's campaign tag; daily totals only, no IP address or file data stored).
• The IRIS CSV files and the review workbook are created in memory and saved by your browser to your computer. The review workbook masks TINs. Closing the tab discards everything.

How to verify it yourself

• Open the app, let it load, switch off your network, convert your file and download the results: it still works.
• Open the browser's developer tools (Network tab) during a run: no request carries your file.
• Read the code: the engine is plain, unminified JavaScript under /core/ (fire.js reads Publication 1220 records, iris.js applies the IRIS rules, convert.js builds the files) and /assets/app.js.

Engine checksums (30 October 2026)

SHA-256 of the files that read and convert your data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed teams can ask for this exact build as a ZIP to host on their own network.

• /core/fire.js: cd95e62f41e33cf14666937023c98552167cf014dcbc13fb29f124baeaca9523
• /core/iris.js: b2e42bb4f87ab8bd4515c12e7e603159415f4d4f3e7ff8afb9050d17f424a409
• /core/iris-spec.js: 9902a139eff2bd200dca97bc32738bc5e38be25c9873c16fb4f28be415980ecb
• /core/convert.js: 92be2bbe09dce3bd0fba4bafec55af7b4cd47935268f28a5f669b4ef18d26a98
• /core/codes.js: 5557515d14cf4e9c7919692dc68ed4fb472e6169928ab4cc50c45b8263242670
• /core/xlsx-read.js: 20bec06f9d312a6b8ade08a493615bf720925a03c813a8d265330a419fb6ae6a
• /core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
• /core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
• /assets/app.js: bbb5194bd6a3d7cbcfffd9192f3902289a1f8e32fb56a84a41e9f01611c91b65

IRS limits applied

• At most 250 forms per CSV upload, one form type and one tax year per file, as IRS Publication 5717 (Rev. 9-2026, section 3.5), the IRIS Taxpayer Portal user guide, requires. The portal then submits at most 100 forms per submission (section 3.6.1).
• Field rules (characters, name control, TIN type, ZIP and country codes) follow the IRS IRIS CSV templates for tax year 2025; the tax year 2026 templates are added when the IRS publishes them.

Browser hardening

• Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site and Paddle; framing blocked.
• No analytics, advertising or tracking cookies. Your license key is kept in the browser's local storage and verified offline with an Ed25519 signature.

Sub-processors

• Cloudflare: hosting of the static site and license endpoints (no payee data).
• Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day. Purchase orders, Paddle's W-9 and a quote PDF: procurement page.