Security notes

Architecture

Rowledger is a static website. The converter is JavaScript and WebAssembly delivered to your browser; it parses PDFs with the open-source pdf.js engine, runs OCR with the open-source Tesseract engine compiled to WebAssembly, and writes export files locally. There is no application server that receives documents, and no database.

What leaves your browser

• Requests for the site's own static files (HTML, scripts, fonts, the OCR engine and language data) — on first load, then cached.
• Anonymous page-view analytics (Cloudflare Web Analytics, no cookies).
• On license activation only: your license key and a device label, sent to Polar's license API.

Nothing else. In particular, no file contents, no extracted data, no file names.

Verifying it

1. Open the converter and wait for the page to load.
2. Disconnect from the internet (airplane mode).
3. Convert a statement and download the export.

Alternatively, open your browser's developer tools, watch the Network tab, and convert: you will see no requests carrying your document.

Hosting

The site is served through Cloudflare with HTTPS enforced. Static assets are content-hashed.

Responsible disclosure

If you find a security issue, email support@rowledger.com. We will acknowledge within two business days.