Security and IT review

• Every calculation and every figure is made inside the browser tab.
• Nothing you paste, type or open is uploaded. There is no endpoint that accepts it.
• No account, no login, no cookies, no tracking or analytics scripts and no third-party scripts.
• The server keeps one thing about visits: a daily page count, with no IP address, no browser details and no identifier.
• The browser enforces a Content Security Policy that lets the page talk to strataplot.com and nothing else.
• A licence is a signed key checked in the browser. Nothing calls home.

The site is static files served from Vercel. When a page loads, the plotting code runs in the tab: a table is parsed by that code, the figure is drawn as SVG in the page, and SVG and PNG exports are produced by the browser itself. A plot never makes a round trip to a server.

There are three server endpoints, and all three belong to buying a licence: one opens a Stripe checkout for a plan name, one turns the completed Stripe session into a signed key, and one receives Stripe’s payment notification and sends the licence email. None of them receives plot data, and there is no database behind them.

One more piece of server code runs before a page is served: a small routing step on Vercel that adds one to that page’s count for the day. It reads no cookie, keeps no IP address and no browser details, never sees the query string, and sends the page whether or not the count succeeds. Exactly what it keeps is on the privacy page.

Every response carries these headers, and the browser applies them whatever the page’s own code tries to do:

• Content-Security-Policy: scripts, fonts and network requests may only come from strataplot.com itself, and images only from there or from the page’s own exports. Plugins are blocked, forms can only submit to this site, and no other site may show these pages in a frame.
• Strict-Transport-Security: HTTPS only, including on subdomains, remembered for two years.
• X-Frame-Options set to DENY, for browsers that predate the policy above.
• Permissions-Policy: camera, microphone, location, screen capture, motion sensors, USB and the payment API are all switched off.
• Referrer-Policy and X-Content-Type-Options: links to other sites carry no page path, and files are only read as the type they are served as.

The policy is what makes “nothing is uploaded” more than a promise: if the code tried to send your data to another server, the browser would refuse the request.

1. Open any tool, then open the browser’s developer tools on the Network tab.
2. Paste or upload a table and export the figure. The list shows no request carrying your data, and none to any other domain.
3. Click the page’s own request at the top of the list to read the response headers above.
4. Once a tool page has loaded, disconnect from the network: the tool keeps plotting and exporting SVG and PNG, licence check included.

A licence is one line of signed text. The browser checks the signature against a public key built into the page, so there is no licence server, no seat count and no check-in. The key is kept in this browser’s localStorage under sp-license, and clearing the site’s data removes it. The same key can be entered on every machine its buyer works on.

Buying a licence involves two: Stripe takes the payment on its own checkout page, so card details never pass through this site, and Resend delivers the licence email. Vercel hosts the site and keeps standard request logs, as every web host does. Upstash, a database provider, stores the daily page-count totals and nothing else. Exactly what each one receives is on the privacy page.

A licence is a one-off card payment through Stripe Checkout: $79 for 12 months of Pro, or $149 once for the lifetime licence. There is no subscription and nothing renews by itself. Each key is issued to one buyer; the terms set out what it permits.

For several keys, a quote before buying, or a purchase order, write to help@strataplot.com and say what your finance team needs.