Your finance files stay on your device.
SupplierRecon reads CSV and XLSX files in browser memory. The reconciliation workspace has no file-upload endpoint, account database or cloud history.
What stays local
- File names, cell contents, references, supplier names and amounts.
- Normalized rows, candidates, reviewer decisions and notes.
- The generated XLSX workpaper until you choose where to save it.
What can be saved
You can save mapping and format-rule templates on this device. The saved template excludes supplier scope confirmation, file names, transaction rows and financial values. Refreshing or closing the page clears the current reconciliation.
The application data boundary
| Operation | Location | Persistence |
|---|---|---|
| CSV/XLSX parsing | Dedicated browser worker | Memory only |
| Normalization and matching | Dedicated browser worker | Memory only |
| Review decisions | Current browser tab | Memory only |
| Rule templates | Browser storage on this device | Only when explicitly saved |
| XLSX export | Dedicated browser worker | Saved only through your download choice |
The included Vercel configuration and portable static-host header policy set connect-src 'none' for the /app path, allow same-origin Blob workers, and deny framing, objects, camera, microphone, geolocation and payment permissions. The production host must apply and verify its native response-header configuration after deployment.
Limits of the proof
Input hashes, supplier scope, rule parameters and the engine version help identify whether a run can be reproduced. The Run Manifest is not a digital signature, does not prove who approved a result, and does not make an XLSX file tamper-proof.
How to verify local processing
- Open the browser network inspector and clear the request list.
- Run the sample through review and export once. Verify that requests fetch only same-origin application assets and never contain file names, references, amounts or cell content.
- Without reloading the page, switch the browser to offline mode and repeat the already-loaded sample flow. Worker assets cached by the browser can continue locally; offline behavior before those assets have loaded depends on browser cache and is not presented as PWA support.
- Close the tab, reopen it and confirm that transaction rows and review decisions are gone while any rule template you deliberately saved remains.
The reconciliation route does not load analytics, replay, advertising or support-chat scripts. Static source tests also reject outbound request APIs in the financial-data modules.