Bite Apps › Security
Security, data flow and offline use
Bite Apps tools are built for files that must not leave the building: FIX logs, bank statements, payment files, ACH batches and DORA registers. This page explains how that is enforced, how to check it yourself, and how to run the tools offline.
Summary for security and procurement teams
- Your files are not uploaded. SafeFIX, SafeCAMT, SafeACH and SafeDORA read and process files with JavaScript inside the browser tab. Bite Apps has no backend that receives, stores or processes customer files, and no user accounts.
- The only outbound request is the license check. Each tool page carries a Content-Security-Policy that blocks every network destination except
https://api.polar.sh, which is contacted only to validate a Pro license key. The free reference pages and the identifier checker allow no network requests at all. - No tracking. No analytics, advertising or third-party scripts, no cookies. Cloudflare is told not to inject its own scripts (
Cache-Control: no-transform). - Reviewable and runnable offline. Every tool is one HTML file with all code inline. You can download it, review it, verify its SHA-256 checksum and run it from disk on a machine without internet access.
Architecture
| Component | What it is | Has access to your files? |
|---|---|---|
| Tool pages | Static HTML files served from Cloudflare Pages: safefix.biteapps.cc, safecamt.biteapps.cc, safeach.biteapps.cc, safedora.biteapps.cc. All JavaScript is inline in the page and allowed by its SHA-256 hash in the Content-Security-Policy; no external scripts, fonts or libraries are loaded. | No — files are read by your browser from your disk |
| Cloudflare | Hosting and CDN for the static pages. Like any web host it processes technical request data (IP address, user agent) to deliver the page. | No |
| Polar (polar.sh) | Merchant of record for Pro purchases (checkout, invoices, VAT) and license-key validation. | No — receives only the license key |
| Your browser storage | localStorage on the tool's own origin: theme, tool settings, an activated license key. SafeFIX Pro can save custom FIX dictionaries in IndexedDB when you choose to. | Stays on your device; clear it with the browser's site-data controls |
Network behaviour
Each tool shows a live counter of the network requests the page has made since it loaded; after you open and check a file it still reads 0. The Content-Security-Policy of the tool pages is:
default-src 'none'; script-src 'sha256-…'; style-src 'unsafe-inline'; img-src 'self' data:; connect-src https://api.polar.sh; base-uri 'none'; form-action 'none'; object-src 'none'; manifest-src 'none'
The request to https://api.polar.sh/v1/customer-portal/license-keys/validate carries the license key, the Bite Apps organization ID and the product's benefit ID. It is sent when you activate a key, when you press “Re-verify”, and once automatically if an earlier check could not complete. No file content, file names or results are ever included. Other HTTP response headers on the tool sites: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy and Cross-Origin-Opener-Policy: same-origin.
Offline copies and checksums
For locked-down workstations or an internal review, download the tool as a single file and verify it against the published SHA-256 checksum (it changes whenever the tool is updated):
| Tool | Offline file | Checksum |
|---|---|---|
| SafeFIX — FIX log analyzer & anonymizer | SafeFIX-offline.html | offline.sha256 |
| SafeCAMT — bank statements and payment files | SafeCAMT-offline.html | offline.sha256 |
| SafeACH — NACHA ACH files | SafeACH-offline.html | offline.sha256 |
| SafeDORA — DORA register of information | SafeDORA-offline.html | offline.sha256 |
Browsers only honour the “download” attribute for the same site; if a link above opens the tool instead, use the link in the tool's own documentation or the browser's “Save page as… → Webpage, HTML only”. On Windows, verify with certutil -hashfile SafeFIX-offline.html SHA256; on macOS or Linux with shasum -a 256 SafeFIX-offline.html.
The offline file works from disk without a network connection. To activate Pro in it, that browser needs to reach api.polar.sh once; if your network blocks it, email us before you buy.
Vendor-security questionnaire: short answers
| Question | Answer |
|---|---|
| Do you store, process or transmit our data? | No. Files are processed in the user's browser and are never sent to Bite Apps or any third party. |
| Where is our data located? | On the user's device only. |
| Subprocessors with access to customer data | None. Cloudflare (hosting) and Polar (payments, license keys) never receive file contents. |
| Personal data processed by Bite Apps | Only what a buyer gives Polar at checkout (name, email, billing details) and support emails. See the privacy policy. |
| User accounts, SSO, MFA, access control | Not applicable — there are no accounts and no server-side data. |
| Encryption in transit / at rest | Pages and the license check use HTTPS (TLS). Nothing is stored server-side, so there is no data at rest with Bite Apps. |
| Third-party code | None loaded at runtime. All code is inline in the page and pinned by a SHA-256 hash in the Content-Security-Policy; you can read it with “View source”. |
| Certifications (SOC 2, ISO 27001), penetration tests | None. Bite Apps is an independent developer. The design keeps your data out of our hands instead; your own team can review the single HTML file and observe its network behaviour. |
| Availability / SLA | No SLA. The offline copy keeps working if the website is unavailable. |
| Vulnerability reports and security contact | support@biteapps.cc (also in security.txt). |
How to verify it yourself
- Open a tool, then DevTools → Network. Load the sample or your own file: no requests appear.
- View the page source: the whole application is in one inline script; the Content-Security-Policy is in the first lines.
- Download the offline file, compare its SHA-256 with
/offline.sha256, disconnect the network and use it from disk.
Last updated 2026-11-12. Questions from your security team: support@biteapps.cc.