How it stays local

Pre-file checks for FINTRAC, FinCEN, and AUSTRAC operators. Checks, scans, and the reject decoder run in this browser. Reports are not uploaded to a filing cloud. The report is never sent to a server.

Does this file or store reports on a server?

No. Checks do not file. Report bodies are not sent. This is not a FINTRAC, FinCEN, or AUSTRAC system. It is not legal advice.

What runs in this browser

Check one, Batch check, Scan transactions, Scan clients, and the reject decoder run in this tab. Deadline radar stays in this browser’s localStorage. The Reject log stays in IndexedDB — file hashes, finding counts, and statuses you type, not the report body. Your region choice is stored as fiuready.region. A purchase email you type to unlock paid downloads stays in this browser. What you paste or load on Check one or Batch check lives in memory for this tab. Close the tab and it is gone. There is no last-form draft.

What still leaves

Notify me on paid-plan screens, Contact, Feedback, and pack-change alerts on Rule packs send the email and message you type to Formspree — never a report. Pack-change alerts are a subscriber list only; this app does not email people when a pack version changes. Page views go to Vercel Analytics (query strings stripped); Speed Insights measures load time. Check one, Batch check, and Reject log call our license API with a stored purchase email, if any. Stripe Checkout is not open. Unlock is the purchase email plus a live Stripe lookup — not a signed license token. Anyone who knows a paying email can unlock paid features.

How to verify

Open DevTools → Network during a Check one run or a scan. The report payload is not POSTed. License lookup (/api/v1/license) appears on Check one, Batch check, and Reject log when those screens check a stored purchase email. Analytics and Speed Insights requests appear on page views. This is not a zero-XHR product.

Browser / transport hardening

Document routes set CDN-Cache-Control and Vercel-CDN-Cache-Control to public, max-age=0, must-revalidate so a new deploy is not served from a stale HTML shell. This repo does not set Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy.

PII on screen

Names, dates of birth, addresses, and identifiers display as [MASKED]. Checks still use the in-memory original on your machine. We do not run free-text identifier scanners.

How to wipe

Clear this site’s data in the browser to remove everything stored here. On a shared or public PC, do that before you leave.

Back to homePrivacy