Hardened, offline and auditable. Every control verifiable on the machine in front of you.
Written for the implementation team and for IT sign-off. Nothing here is taken on trust: the offline guard, the audit trail, the access controls, the authorisation gate and the build identity can each be demonstrated in minutes.
What we're deploying.
| Purpose | Reads scanned supplier delivery notes (any supplier, taught from one clean docket), cross-checks Chemistry lot acceptance, updates the receiving department's controlled logs, and helps stores staff keep the shelf stocked. |
|---|---|
| Data handled | Supplier delivery data, treated as confidential, and the laboratory's log workbooks (.xlsm / .xlsx). All of it stays on the host PC. |
| Architecture | Local web app bound to 127.0.0.1:5759 only. Unreachable from the network; no listener on any external interface. |
| Footprint | Self-contained folder that runs from USB or local disk. No installation, no admin rights, no services, no registry changes. |
| Dependencies | None on the target beyond Microsoft Excel, used only for log writes. The OCR engine and typefaces ship inside the folder; nothing is fetched from the web. A USB barcode scanner, if used, is an ordinary keyboard device. |
| Provenance | Independently designed and developed by the author; personal IP used under licence, with a complete version-controlled history. |
Offline is enforced, not promised.
A runtime network guard loads before anything else and wraps the socket layer. The banner shows a yellow Offline badge with a red light whenever the guard is running, and the audit log records network_guard=active at every start.
Loopback only, refused at socket level
- Only
127.0.0.1connections are permitted; any outbound attempt is refused at socket level. - Every blocked attempt is written to
network_audit.logwith a timestamp. - The absence of entries after a full workload is positive evidence of no call-home behaviour.
No AI, no cloud, no telemetry
- OCR is the bundled Tesseract engine, running locally: deterministic, no model calls.
- No analytics, update checks or crash reporting of any kind.
- Confidential delivery data is never transmitted anywhere.
- Expiry reminders are a calendar file saved beside the app and carried to Outlook by hand; the app never connects to Outlook or Teams.
Hardened at the request layer.
Cross-origin protection
All 31 state-changing routes check the request origin. A request from any other origin, for example a malicious page in the user's browser, is refused with 403 and never processed. Re-verified in every release check.
Path and write confinement
Download and open-folder routes refuse anything outside the app's folders. Log writes are confined by resolved path to the receiving department's working copies, never an original, the drive's master copies, or another department's logs.
Upload validation
Only Excel workbooks are accepted, size-capped and checked before use. A logs folder is checked file by file, and anything without a receipt sheet is named and left out. Staging happens inside the app folder, never the host's temp directory.
Controlled errors
All errors return structured JSON. No stack traces or server internals are ever exposed to the page.
Every action attributable, every run accountable.
audit.log records every user action with the Windows username, timestamp, the release that performed it, and the details, tab-delimited for easy review. Event logging follows PSPF and ISM-aligned practice: who, what and when, and which version of the software did it.
What is logged
- App start, with guard status.
- Uploads of the register and the logs folder.
- Every cross-check and every new-lot confirmation.
- Every log write: receipts, Dates in Use and removals, with rows written, skipped and overwritten.
- Every assessment pack built, and every authorisation event.
The controlled workbooks stay controlled.
Macros never run
Log writes drive Excel with macro execution disabled (AutomationSecurity=ForceDisable). The workbooks' macros and validation rules are preserved but never executed.
Backup before every write
A timestamped copy of each workbook is taken before any change, so any write can be rolled back.
Originals preserved
Dropped workbooks and logs folders are kept untouched in original_logs\; all changes go to working copies in updated_logs\. Dropping again archives the copies it replaces in archived_logs\.
Writes land where they should
Receipt columns are located from each sheet's own headings, and writes are confined to the receiving department's working copies.
Data beside the app
PDFs, reports, assessment packs, expiry reminder files, logs, upload staging, shelf counts and taught barcode layouts live in the app's own folders. Nothing is written elsewhere.
Human confirmation
Only operator-confirmed quantities, Dates in Use and removals are written, each previewed first. OCR and scanned values are drafts, never an authority.
Encrypted at rest. The logs it stores, the register, master stock, backups, lot history, sign-offs and answer keys are locked on the drive and unlocked only while the app works. The audit logs and licence files stay readable so they can be checked without the key. A second lock under BitLocker; keep the drive as you would the logs themselves.
Every copy accounted for, every copy current.
The app is deliberately offline, which also means it can never phone home for updates. Site authorisation is how copies are kept track of, so security fixes and feature updates reach them instead of stale copies drifting on unnoticed.
How it works
- Site authorisation is a digitally signed file listing the machines approved to run, verified fully offline, no server involved.
- The machine ID is a one-way SHA-256 hash of three read-only values (system UUID, volume serial, hostname); the values themselves are never shown, stored or transmitted.
- Short-term access codes cover evaluations and stand-in machines: three months from first use.
- A copy that was never authorised does not run. One past its term stops receiving into the logs, but never locks the laboratory out of its own records.
Recommendations for IT
- Use BitLocker-encrypted USB sticks when the folder travels between machines.
- Exclude scanned delivery PDFs from any unencrypted media.
- Keep the app folder out of shared or synced locations.
- The executable is unsigned, so application control may prompt or block; the identical source-folder version (plain Python) is the fallback.
- Review the README's “Data privacy and offline assurance” section, written for IT and compliance sign-off.
The licence term, renewal notices and read-only behaviour are described on the deployment and licensing page.
Prove it in ten minutes.
Eight checks, on the machine in front of you.
0 of 8 verifiedNot yet verifiedTick each one as you demonstrate it. The checklist ships with the product.
Questions your security team wants answered first?
Ask them before the walkthrough. Every answer comes with the check that proves it.