Security & trust
Your schedule data never leaves your machine. That's the design.
SSIM Toolkit is a local desktop app. Commercial schedule data — the kind that makes a CISO read the policy before the product page — is read and analysed on-device, and stays there. There is no cloud to send it to.
- Local-first by design
- No data leaves your device
- Deterministic · reproducible
- Signed installers
Data flow
Where the data goes. And where it doesn't.
Your schedule files
Your schedule files stay where you put them — on your machine. They're opened, parsed, and analysed locally and never uploaded. We have no server that could read them, because there is no server in the path.
The pipeline
Parse → validate → analyse runs entirely on-device. The result is deterministic: the same file always produces the same answer, and every output traces back to a field in the spec — no model computes your numbers.
What we never see
- Your schedule file contents · ever.
- The parsed records, or any personal data inside them.
- Your saved queries, bookmarks, or in-app notes.
How it's built
Local-first, by construction.
The controls an information-security review will ask about, in plain words.
Your data, on your machine
Schedule files are read, parsed, and analysed entirely on-device. Nothing about your schedules is uploaded, mirrored, or processed on our servers.
The analysis runs on your machine
Parse → validate → analyse runs on your computer, against the files you open. No step of it happens on our servers.
Deterministic by construction
Same file in, same answer out. There is no model, no sampling, no guessing — every field is derived from the spec, and runs are reproducible.
Code-signing
The macOS build is notarised and the Windows installer carries a verified publisher, so each installer verifies on its platform.
Reporting a vulnerability
Found something? Tell us first.
Email security@activeflights.com. We acknowledge every report, agree a disclosure date with you, and credit researchers who report responsibly.