Simon G. · for the IT department
A note for the IT department
A colleague wants to use the free Simon G. tools with company data. This page says what the tools are, what they do with that data, and how you can check each statement.
In short
| What they are | Four static web pages, also available as one HTML file for use without a network: Stock Check, Working Capital Check, Credit Check, Decision Charter. |
|---|---|
| Server side | None. There is no account, no upload and no database. The site serves files and nothing else. |
| Where the data goes | Nowhere. The file a user chooses is read by the browser and processed in the page. Results are shown on screen and can be saved by the user as files. |
| What enforces it | A content security policy in each page that forbids every connection. The browser enforces it. |
| Installation | None. No administrator rights, no browser extension, no plug-in. |
| Third parties | None on the tool pages: no analytics, no fonts or scripts from other hosts, no cookies. |
The policy
Each tool page on groma.ro carries this policy in the first lines of its source:
default-src 'none'; script-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; worker-src 'self'; connect-src 'none'; form-action 'none'; base-uri 'none'
The offline file carries this one. It lists the SHA-256 fingerprint of every script and every style block in the file, so nothing else can run:
default-src 'none'; script-src <16 fingerprints>; style-src <8 fingerprints>; font-src data:; img-src data:; worker-src blob:; connect-src 'none'; form-action 'none'; base-uri 'none'
- connect-src 'none' blocks fetch, XMLHttpRequest, WebSocket and beacons.
- default-src 'none' blocks everything not listed, including frames and media from any address.
- img-src allows the page's own images and inline images only, so data cannot leave inside an image address.
- form-action 'none' blocks form submission.
- A policy does not stop a user from following a link. The links in the tools point to groma.ro and carry no data.
How to check
| Read the policy | Open the page source. The policy is in the first lines. |
|---|---|
| Watch the network | Open the developer tools, Network tab, then load a file and run a tool. After the page has loaded, no request appears. |
| Pull the cable | Open the offline file with the network disconnected. Everything works. |
| Run the self-test | Open the offline file with #selftest at the end of its address. It runs the tools on invented data and writes PASS or FAIL in the data-selftest attribute of the page. |
| Check the fingerprint | Compare the SHA-256 of the offline file with the one on the download page: certutil -hashfile simon-g-tools.html SHA256 |
| Read the code | The page code, the tests and the build scripts are public: github.com/Porta-dob/simon-g-tools. The offline file is built from the published pages by offline/tools/build.mjs. |
What the tools read and write
| Files read | Excel (.xlsx, .xlsm) and CSV, chosen by the user. Macros are not executed: the page reads the cell values with its own reader, under 200 lines, with no library. |
|---|---|
| Files written | Only when the user presses a button: results as CSV, decision records as JSON, a workspace file as JSON, and printing. They go to the browser's download folder. |
| Stored in the browser | The Decision Charter keeps its draft in the browser's local storage on that computer; its "Clear" button removes it. The other three tools store nothing. |
| Cookies | None. |
| Updates | The pages on the site change when we publish a new version. The offline file never changes by itself. |
What is counted
- The tool pages and the offline file count nothing.
- The other pages of groma.ro count visits with the hosting provider's counter, without cookies. The download pages also count a press on a download button, with the file name.
- A second counter on those pages loads only if the visitor accepts it in the banner.
Requirements, licence, contact
| Browser | A current browser. Tested in Chrome and Edge. The Excel reader needs a browser version from mid-2023 or later. |
|---|---|
| Licence | Page code: Apache-2.0. Calculation engine: FSL-1.1-ALv2, free for your internal use; it may not be offered as a competing product, and it becomes Apache-2.0 two years after each release. |
| Warranty | None. The tools propose; a person decides. |
| Publisher | GROMA S.R.L., Timișoara, Romania, CUI 54804217. |
| Security contact | contact@groma.ro. Write to us if you find a way to make a tool send data. |