Security & 0 KB Upload

1. Summary

• 0 KB of your workbook uploaded. There is no upload endpoint for workbook data. The file is read into the memory of your browser tab and processed there.
• No installation, no administrator rights. NormXL runs in the browser your IT team already manages.
• No AI and no cloud processing. No language model reads your formulas, and no server stores your workbook or its results.
• No processor for your workbook’s contents. Because nothing is transmitted, there is no third party to assess and no data processing agreement to negotiate for them.
• Verifiable. Open the browser’s network monitor, drop a file, and see for yourself that no request carries it.

2. Architecture

The NormXL engine is delivered as WebAssembly and JavaScript from normxl.com and runs inside the browser’s sandbox, the same isolation that protects you from any web page. When you drop a workbook:

1. the browser reads the file into the memory of that tab;
2. the engine computes the SHA-256 fingerprint of the exact bytes, parses the workbook and recalculates its formulas independently;
3. the Validation Dossier (PDF and DOCX) is assembled in the same tab;
4. the browser saves the Dossier to your downloads folder or a location you choose on your own drive.

The workbook never leaves the tab, and the Dossier is never sent to us. When you close the tab, the browser releases its memory. We keep no copy of either file, which is also why we ask customers to store their Dossiers in their own document control system.

Macros are analysed as text and never executed. External data connections, Power Query queries and add-ins are not refreshed or run; formulas that depend on them are listed as not independently recalculated. NormXL is designed never to run code contained in a workbook.

3. What leaves your browser, and what never does

4. Verify it yourself in one minute

1. Open normxl.com in Edge, Chrome or Firefox and press F12 (Safari: enable the Develop menu, then Show Web Inspector).
2. Open the Network tab, tick Preserve log, and clear the list.
3. Drop a workbook onto the fingerprint check and quick count on the home page.
4. Watch the list: the fingerprint and, for most workbooks, the counts appear on the page, and no request carries the file, its name, its size, its fingerprint or the counts.

For a stricter test, load the page, disconnect the computer from the network, and run the qualification offline: it completes without a connection. For air-gapped sites, a single-file offline edition is available.

5. Deployment requirements

• A current version of Microsoft Edge, Google Chrome, Mozilla Firefox or Apple Safari, with JavaScript and WebAssembly enabled.
• No installer, no browser extension, no Excel add-in and no administrator rights; nothing for IT to package, allow-list or patch.
• Network access to normxl.com to load the pages.
• Supported workbooks: .xlsx and .xlsm.

6. Integrity: the SHA-256 fingerprint

Every Dossier names the SHA-256 fingerprint of the exact file it validated. Anyone can recompute it with tools already on their computer and compare it with the Dossier:

• Windows: certutil -hashfile workbook.xlsx SHA256
• macOS: shasum -a 256 workbook.xlsx
• Linux: sha256sum workbook.xlsx

If a single byte of the workbook changes, the fingerprint changes, so a copy on a laptop can be checked against the validated master at any time. The fingerprint identifies the file; the approval of the record remains your organisation’s signature in the Dossier’s release block.

7. Confidentiality obligations

ISO/IEC 17025 and ISO/IEC 17020 (both in Clause 4.2) make you answerable for the confidentiality of client information, and many client agreements forbid passing it to third parties. Because NormXL processes the workbook only on your workstation, client data in your spreadsheets is not disclosed to us or to any sub-processor. The same applies to product data under ISO 13485 and to personal data that a workbook may contain: we receive none of it.

8. The website itself

• Served over HTTPS only, with HTTP Strict Transport Security.
• A strict Content Security Policy: no inline scripts; styles and fonts load only from normxl.com; scripts load only from normxl.com and, when analytics are enabled on this site, from Google’s tag domains, which the page contacts only after you accept analytics; the site cannot be framed by other sites.
• No third-party code runs until you accept analytics in the cookie banner; fonts are hosted on normxl.com, not loaded from external services.
• Hosted in the European Union (Poland). Form submissions are protected against automated abuse; IP addresses used for that purpose are stored only as salted one-way hashes, kept for 24 hours.

How personal data from the forms is handled is described in our Privacy Policy.

9. What we do not claim

NormXL does not currently hold an ISO/IEC 27001 certification or a SOC 2 report, and the website and software have not yet been through an independent penetration test. We describe the architecture precisely instead, so that your team can verify the essential property, that the workbook never leaves the browser, without having to take our word for it.

10. Questionnaires and vulnerability reports

If your organisation needs a supplier or security questionnaire completed, email it to info@normxl.com; we answer every question directly.

If you believe you have found a security vulnerability in normxl.com or in NormXL, please email info@normxl.com with “Security report” in the subject and enough detail to reproduce it. We normally acknowledge a report within one working day, and we do not take action against good-faith research that avoids harm to our users and their data.