Security

Security here has two parts that are easy to confuse. The first is the calculation, which is built so that it can only compute. The second is everything around it: this website, its form, and the interfaces that carry your data to an engine. The two are described separately below.

The engines can only compute

An engine is a function. It takes numbers and returns numbers. It cannot open a file, make a network call, read the clock, or draw a random number that you did not seed. That is not a policy we ask people to follow. It is how the code is written. The calculation kernel imports no module that does input or output, and it never touches the clock, the network, storage or the page. A test reads every file of the kernel and fails if one of those appears.

The same property makes a receipt reproducible. Because nothing outside the inputs can change the answer, a laptop, a browser and a server return the same figures to the last bit, and the verification page shows them doing so.

This covers the calculation. It does not cover the web page, the command line or the interface that gives the calculation its inputs. Those handle your data, and the rest of this page is about them.

Your data

• The calculators on this site run in your browser. What you type into one is not sent anywhere. You can check this in your browser’s network panel.
• Licensed engines run where you put them. On a device the data stays on the machine, and in your own estate it stays inside your network, including one with no way out. At the edge we run the engine for you, near the user: the data goes to our endpoint over TLS, is worked on in memory and is not stored. The platform page sets the three side by side.
• Messages you send through the contact form are stored as described in the privacy notice, and for as long as it says.

This site

• Pages are built ahead of time and served from Cloudflare’s network. Three parts run code when you ask: the contact form, the specification feed and the receipt check.
• Everything the site needs comes from graphatlas.com. It loads no script, font, image or style from another company, so the content security policy can name a single origin. A script runs only if it is a file from this site or an inline block whose hash is in the policy, so a script that someone slipped into a page would not run. The policy does allow style attributes, which the code samples and the bars in the calculators use for colours and sizes. A style attribute cannot run a script.
• Every page, file and endpoint carries headers that tell the browser to use HTTPS only, not to guess content types, not to be framed by other sites, to send no referrer to other sites and to withhold device features the site never uses.
• The contact form checks each field in the browser for your convenience and again on the server because the server cannot trust the browser. The database refuses any row that breaks the same rules, so a bug in one layer cannot quietly store bad data. Nothing a visitor writes is ever put into a page as HTML.

Our supply chain

• The kernel has no dependencies. It is TypeScript that imports only files of our own repository.
• The browser receives one library besides our own code, Preact, and the colophon lists it with its version.
• We commit a lockfile, install from it, and run the package audit before every release. Building the same commit twice in one folder gives the same files, byte for byte. In a folder with another path the pages differ only in the ids of their interactive parts, and the Worker in the path that it holds.

Reporting a weakness

If you think you have found a weakness, write to contact@graphatlas.com with Security in the subject. The same details are in our security.txt.

Tell us what you found, where, and how to see it. We acknowledge a report within two working days and tell you what we make of it within five. We keep you informed until it is fixed, and with your permission we name you when we publish the fix.

If you want to send something sensitive and would rather encrypt it, say so in a first message with no details, and we will arrange a channel.

What is in scope is graphatlas.com and the interfaces that belong to it. Denial of service, social engineering of our staff, physical attacks and weaknesses in other companies’ services are not. If you act in good faith, within that scope, and stop when you reach data that is not yours, we will not take legal action against you and we will say so to anyone who asks.

Assurance and certification

We hold no third-party security certification today, and we would rather say so than imply otherwise.

Changes to this page

• 10 November 2026. Reports of a weakness now go to contact@graphatlas.com, with Security in the subject, which is the one address that the site has, and the security.txt file says the same. What we say about the engines and about this site is as it was.
• 4 November 2026. The sentence about licensed engines said that we receive nothing, wherever they run. At the edge that is not so, since we run the engine there, and the platform page said as much. It now says what each of the three places does with your data. The page also begins with the short answers that a review asks for first.
• 1 November 2026. The sentence about building a commit twice said more than we had measured. We built a commit three times in clean clones and compared the files, and two builds of it differed in a key that the framework makes at random and in one source map. Both are fixed, and the sentence now says what the comparison finds.
• 29 October 2026. First version.