Security and architecture

Last updated 30 October 2026 · for security and procurement reviews

Data flow

The app is a static web page. Your bid sheet and school list are opened with the browser's File API and processed by JavaScript in the tab.
No request ever carries a bid, a price, a student count or a result. Our server (a Cloudflare Worker) serves the page and answers three small endpoints for licensing: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check, plus an anonymous visit counter (an event name such as "sample opened" and the link's campaign tag; daily totals only, no IP address or file data stored).
The optional Form 470 lookup is a direct browser request to USAC's public open data (opendata.usac.org) with the form number only.
Downloads are created in memory and saved by your browser to your computer. Closing the tab discards everything.

How to verify it yourself

Open the app, let it load, switch off your network, run your bid sheet and download the results: it still works.
Open the browser's developer tools (Network tab) during a run: there are no requests.
Read the code: the engine is plain, unminified JavaScript under /core/ (erate.js applies the rules, outputs.js builds the files) and /assets/app.js.

Engine checksums (release 1.0.0, 30 October 2026)

SHA-256 of the files that read and process your data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256. Licensed teams can ask for this exact build as a ZIP to host on their own network.

/core/erate.js: e682ead62b15b69a299bee87f03fb80c673e56fb7eb80fbb859be2bf0e2f1c61
/core/outputs.js: 38c86cce5007de3d4c8b861cdb67d915f2224a393ec5e8f5514952f8aaf08fd8
/core/xlsx-read.js: 20bec06f9d312a6b8ade08a493615bf720925a03c813a8d265330a419fb6ae6a
/core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
/core/csv.js: 909344fa414ff1a60621e55367e8247deeaf3d8d1c85b9c7bd6ed055a9c728e0
/assets/app.js: 34621d1e76a3c3d15f4a4e8f6b339f483a623cabcf99d735b30dab53b1180ffa

Rule check

Every time the app opens it reproduces 17 of USAC's own examples and published records: the three example matrices of "How to construct an evaluation" and a counter-example, the discounts of six real FY2026 applications, four FY2026–FY2030 Category Two budgets and three allowable contract dates (17/17 today).

Check	USAC	Bidtally
USAC matrix example1	compliant	compliant	✓
USAC matrix example2	compliant	compliant	✓
USAC matrix multiRound	compliant	compliant	✓
Matrix with price below another factor	not compliant	not compliant	✓
Discount: Avon Local School District (OH), FY2026 application 261000006	40/40	40/40	✓
Discount: Centennial School District (PA), FY2026 application 261000007	60/60	60/60	✓
Discount: Alamosa School Dist Re 11 J (CO), FY2026 application 261000013	90/85	90/85	✓
Discount: Amethod Public Schools (CA), FY2026 application 261000015	90/85	90/85	✓
Discount: Academy Indep School District (TX), FY2026 application 261000016	70/70	70/70	✓
Discount: Alpha Public Schools (CA), FY2026 application 261000024	80/80	80/80	✓
C2 budget: The Emerge School for Autism (LA), 48 students	30175	30175	✓
C2 budget: Pahin Sinte Owayawa (SD), 205 students	41321.85	41321.85	✓
C2 budget: Madison Valley Public Library (MT), 6,000 sq ft	32580	32580	✓
C2 budget: Diné College (AZ), 30,226 sq ft	164127.18	164127.18	✓
Allowable contract date: Collingswood School District (NJ), Form 470 270000955	2026-11-23	2026-11-23	✓
Allowable contract date: Tucson Unified School District (AZ), Form 470 270002130	2026-11-25	2026-11-25	✓
Allowable contract date: City of Aniak (AK), Form 470 270001631	2026-11-25	2026-11-25	✓

Sources: USAC, How to construct an evaluation (example matrices); USAC open data: Form 471 discount calculations (upfy-khtr), C2 budget tool data FY2026–2030 (6brt-5pbv), Form 470 (jp7a-89nd), read 30 October 2026.

Browser hardening

Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site, opendata.usac.org and Paddle; framing blocked.
No analytics, advertising or tracking cookies. Your license key is kept in the browser's local storage and verified offline with an Ed25519 signature.

Sub-processors

Cloudflare: hosting of the static site and license endpoints (no bid data).
Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day.