Your business data never leaves your machine
Anyone who runs a marketing budget through a tool enters revenue figures, cost structures, and plans - numbers no one internally likes sending through someone else's cloud. YourValidator solves this not with assurances but with architecture: the calculation core runs entirely in your browser, with no server-side processing. This page summarizes what that means technically - written plainly, so you can cite it for internal sign-off and IT reviews.
Client-side only: the data exists nowhere else
All inputs and strategic simulations are processed exclusively in your browser, locally. There is no central database from which your business-critical figures could be intercepted - because that database does not exist.
Zero-knowledge data ownership
Revenue figures, cost structures, and budget plans never leave your device, not even in anonymized form. No transfer to any server takes place. The operator cannot see your models because they technically never reach it.
No attack surface through accounts
Using the calculation core requires no registration and no email address. No account or user data is created on the system at all, so there is nothing to be compromised. The safest user database is the one that was never created.
Encrypted backups (AES-256)
Local backups and strategy exports can be encrypted with AES-256 directly on your machine before you pass them on within your team. That keeps a backup protected even once it leaves your computer by email or cloud folder.
What never leaves the device cannot be intercepted in transit.
Strict separation: the sandbox principle
The calculation engine operates technically fully isolated from the license and payment servers. A potential security incident on the billing layer would therefore have no access whatsoever to your mathematical models or data structures. The two layers - paying and calculating - never touch. Your payment information is stored exclusively by the payment provider. YourValidator itself never stores this information.
Server hardening and operation
The minimal server infrastructure only serves the web app; it does not process your data. It is hardened to common B2B standards:
- Tests: To ensure maximum stability, the calculation engine is continuously tested using automated Playwright scenarios and fuzzing tests with extreme values - with the goal of achieving an error - free developer console (F12) even under intensive use.
- Attack protection: protection via ModSecurity using the OWASP Core Rule Set, plus dynamic IP blocking via Fail2Ban against automated brute-force attacks.
- Encryption & headers: the HTTP security headers (incl. CSP, HSTS) consistently earn the top grade A in audits.
- Offline capability (air-gapped operation): as a progressive web app, the calculation core works fully offline after loading once - you can run strategies in a completely internet-isolated environment if needed.
Built lean, measurably fast
By avoiding heavy tracking scripts and external libraries, the application stays lightweight - which is itself a security advantage, because every third-party library included is an additional attack surface. The Google Lighthouse measurements document the result:
- Desktop: green
- Mobile: green (cache-validated)
Lighthouse measures performance, accessibility, and best practices of delivery - not a substitute for a security audit, but a verifiable indicator of a lean, maintainable codebase.
The limit - what stays your responsibility
Client-side architecture protects the data by never letting it leave the machine. What happens to it after that is no longer up to the tool but up to you. Stated honestly, that means:
- The password is the key - and your responsibility. AES-256 is only as strong as the password you set. It is stored nowhere and cannot be recovered. A lost password means a lost backup.
- Your own device is part of the security. Because the data lives locally, its protection also depends on your machine: a compromised device compromises local files too. That is not a flaw of the architecture but the flip side of data ownership.
- This is not a certification. "Client-side" is a verifiable technical property, not a compliance seal. Where your organization requires a formal certificate, this page is the documented basis for it - not a replacement.
Common security questions
Is my revenue and budget data transferred to a server?
No. All inputs and simulations are processed exclusively in your browser. There is no server-side processing and no central cloud database holding your revenue figures, cost structures, or budget plans. The data never leaves your device. Only if you use the optional AI assistant with your own API key are inputs sent directly to your AI provider.
Do I need an account or an email address?
No. Using the calculation core requires no registration and no email. No account or user data is created on the system at all, so there is nothing to be compromised - the simplest form of data security is that the data never exists in the first place.
How secure are my backups?
Local backups and strategy exports (Pro) can be encrypted with AES-256 directly on your machine before you share them with your team. The encryption is only as strong as the password you set: the password itself is stored nowhere and cannot be recovered. Responsibility for storage and sharing stays with you.
Does the tool work offline?
Yes. As a progressive web app, the entire calculation core works fully offline after loading once. You can run your strategies in a completely internet-isolated environment if needed (air-gapped operation).
What does the sandbox separation mean?
The calculation engine is technically fully separated from the license and payment servers. A security incident on the billing layer would therefore have no access to your mathematical models or data structures - the two layers never touch.
