Knowledge base / Licensing, security and releases

Security and privacy

ClearDuty is a static web application. There is no server behind it that receives your data.

Your SAP data

• Files are read inside your browser and analysed there. Nothing is uploaded.
• A copy is kept in this browser's own storage until you clear it (Data → Clear all data). Very large datasets are better saved as a workspace file.
• After the first visit the tool works with the network switched off.
• No generative AI model is connected and nothing is sent to an AI provider.

The website

• HTTPS only, TLS 1.2 or newer, HSTS.
• A strict Content-Security-Policy: scripts only from clearduty.eu, pinned by hash; no third-party scripts, fonts or trackers.
• No cookies, no analytics, no tracking.
• The Excel library (SheetJS) is version 0.20.3, which fixes the known prototype-pollution issue in older versions.

Connector

If you use the Connector, it runs inside your network with a read-only SAP service user and a bearer token. The browser fetches the extracts from it directly; nothing passes through clearduty.eu.

Reporting a vulnerability

E-mail john.muzam@muzamconsulting.com with "ClearDuty security" in the subject.

Still stuck? Ask us — we answer within one working day.