Copy it on. Delete it off.
A single self-contained folder that runs from the PC's local disk or, if you prefer, an encrypted USB stick, on a PC that has never seen the network. Microsoft Excel is the only thing it asks of the host.
- received_sheets\reports, worklists, outlooks, assessment packs
- original_logs\the pristine copies, never written to
- updated_logs\working copies, every write lands here
- archived_logs\what a fresh drop replaced
- history_logs\past years' logs, read only · locked
- stores\order ticks, shelf counts, delivery times
- Teams reminders\expiry reminders for the team's calendar
- lot_history\ · reviews\lot history and sign-offs · locked
- reader_truth\answer keys for scoring the reader · locked
- audit.logevery action, hash-chained, readable
- network_audit.logevery blocked connection attempt
Runs where the network cannot reach.
- Ships as one folder. Copy it on, delete it off. No installer, no services, no scheduled tasks, no registry writes, no admin rights.
- Designed for a non-networked PC. Nothing degrades without a network, because nothing ever needed one.
- Excel is the only host dependency, used solely for writing the laboratory's log workbooks. The OCR engine and typefaces ship inside the folder.
- Every build hash-verified onto the portable drive against the build output, with release, section versions and commit embedded at build time.
- Application control friendly. The executable is unsigned, so site policy may prompt or block; the identical source-folder version, plain Python, is the fallback.
Two editions from one code base.
Generic edition
LotWarden as shown on this site. Any supplier, any department, taught from your own dockets and logs. The edition used for evaluations and walkthroughs.
Site edition
Your name, logos and wording, bundled only in your own build. The same code, the same release check, the same validation dossier, carrying your identity in the banner and on every report and pack.
Chemistry gets the pre-acceptance register cross-check. Every other department gets new-lot flagging, confirmation before write and verification at the bench, with each product routed to the log and sheet that names it.
Verified offline, per site, per machine.
An offline tool that spreads by folder-copy would otherwise run forever, anywhere, on whatever version it left with, unpatched and untracked. Authorisation is how every copy stays accounted for and current.
A signed file, no server
Each site holds a fixed-term authorisation naming its machines, issued by the author as a digitally signed file and verified fully offline.
A one-way machine identity
The machine ID is a SHA-256 hash of three read-only values: system UUID, volume serial and hostname. The values themselves are never shown, stored or transmitted.
Renewal is the touchpoint
Adding a machine or renewing tells us the copy exists and where it runs, and gives a natural moment to supply the current build with its security fixes.
Evaluation codes
Short-term access codes cover evaluations and stand-in machines: three months from first use, on a machine of your own, against your own logs.
Never locked out
A copy that was never authorised does not run. One past its term stops receiving into the logs, but records stay readable and exportable. The laboratory is never locked out of its own records.
Pricing
Site licences are priced per site and term, by the number of departments and machines. Ask for a quote at the walkthrough; there is no list price on this page because every laboratory's footprint is different.
Plenty of warning, then read-only. Never a lock-out.
Renewal notice
A notice in the footer from 30 days before the term ends. Let whoever looks after the licence know.
Authorisation expired
A yellow banner at the top of the page. Everything still works for 30 days' grace until the date shown.
Read-only
A red banner. Records stay readable and exportable, dockets can still be read and cross-checked. Nothing is written into the logs, logs cannot be dropped and layouts cannot be taught. Apply the renewal file or an access code from the banner.
In the audit log
Every authorisation event is recorded in the hash-chained audit log, so a lapsed machine is recognised by its own records. Winding the clock back makes it read-only too.
The unlock screen appears only on a computer that has never been authorised.
Before the walkthrough.
Does it need a server, a database or an account?
No. It is a local web app bound to 127.0.0.1 on one PC, with its data in its own folder. There is no server component, no database service and no user account beyond the Windows login, which is what the audit log records.
Can we run it from a USB stick?
Yes, and that is the intended pattern for a bench PC. Use a BitLocker-encrypted stick when the folder travels between machines, and keep the folder out of shared or synced locations.
What about Excel macros in our controlled workbooks?
Log writes drive Excel with macro execution disabled, so the workbooks' macros and validation rules are preserved but never executed. A timestamped backup is taken before any write.
How do updates reach an offline machine?
With the renewal or when a machine is added: the current build is supplied, hash-verified onto the drive. The app never phones home, so nothing arrives unannounced.
Our application control blocks unsigned executables.
Expected. The identical source-folder version, plain Python, is the fallback and behaves the same, with the same release check and dossier.
Try it on a machine of your own for three months.
An evaluation code, the generic edition, your own logs. No commitment.