The workbooks you load are opened by the browser’s own file reader,
pivoted in memory, and drawn on this screen. No copy of any of them is ever
transmitted, uploaded, or stored anywhere — not on a server, not in the
cloud, not here. That holds however many runs you load at once: they are read one after
another on this machine and none of them goes anywhere. The only file that leaves the tab
is the CSV you click to download, which the browser writes straight to your own Downloads
folder.
Once this page has loaded it makes no network requests at all. There
is no analytics, no telemetry, no crash or error reporting, no update check, no tracking
pixel, no web font, and no CDN. It loads exactly four files —
styles.css, engine.js, validation.js, and
vendor/xlsx.full.min.js — and then nothing further, no matter what you
do with it. The spreadsheet reader (SheetJS) is kept as a local copy rather than pulled
from a CDN for precisely this reason.
If you opened this over the web, then those four files were of course
downloaded from a web server, and that server logged the page request the way every web
server does. It never sees your workbooks, because your workbooks are
never sent — they are read by the browser on your own machine and stay there.
Want it genuinely air‑gapped? Ask for a copy of the folder,
open validation.html from your own disk, and disconnect. It behaves
identically — turn off Wi‑Fi, unplug the cable, put the machine in airplane
mode, run it on a computer that has never been networked. Nothing about this tool needs a
connection.
This is enforced, not merely promised. The page ships a Content
Security Policy of connect-src 'none', so the browser itself refuses any
outbound request the page could attempt — fetch,
XMLHttpRequest, WebSocket, EventSource or beacon — whether or not
such a request exists in the code, now or after any future edit. It also blocks form
submissions, embedded frames, and plugins.
Confirm it for yourself
- Disconnect and use it. The most direct test there is. If you loaded
this page from the web, pull the plug now and carry on — loading eleven
workbooks, mapping them, and downloading the CSV all keep working with no
connection.
- Watch the network. Open DevTools (F12) → Network,
reload, then load the runs and export. After the four files that make up the page,
the request log stays empty — loading workbooks and exporting them adds
nothing.
- Read the source. It’s four plain-text files. Searching them
for
fetch(, XMLHttpRequest, WebSocket,
sendBeacon, or http turns up nothing — in this
project’s code or in the vendored SheetJS build. The http:// strings
inside SheetJS are XML namespace identifiers from the Excel file format
(e.g. http://www.w3.org/1999/xlink); they are labels compared as text and
are never requested.
- Have someone else read it. The source is available on request, so
you don’t have to take any of this on trust — nor do your colleagues, QA, or
IT. Every line is open to review, along with the full history of every change. Ask and
it will be shared with whoever needs to sign off on it.
Review the complete source
The repository is private. Access is given on request — to you, and to anyone
you need to satisfy.
Request access to the repo
Opens your own mail program with a message to
david@beuttel.net. It carries nothing but that fixed text — no part of
this page, and nothing from your workbooks, goes into it. Nothing is sent until you
press send.
You can also copy the whole folder onto a machine that has never
been networked, or onto a USB stick, and it will work there unchanged.