Security and architecture

Last updated 30 October 2026 · for security reviews, auditors and procurement

Data flow

The app is a static web page. Issue details and fund ledgers are read from your keyboard or from a file you drop, and computed in the browser tab. They are never uploaded.
The Texas issue list (/data/tx-issues.json) is a static copy of the Texas Bond Review Board's public open data, loaded like any other page file.
Licensing uses three small endpoints: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check. A fourth counts anonymous daily page events.

How to verify it yourself

Open the browser's developer tools (Network tab) during a check: no request carries your data.
Read the code: the engine is plain, unminified JavaScript under /core/ (rebate.js applies the rules, outputs.js builds the files) and /assets/app.js.

Engine checksums (release 1.0.0, 30 October 2026)

SHA-256 of the files that read and process the data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256.

/core/rebate.js: e2bfd27c3a74d54a6d28cfdeade3cb41323c74e134b46c74a470be34395ac412
/core/outputs.js: c8e0a3eb077cbed1be909d624ced7f4d4ffbba8eb115e4bde89613d49963b215
/core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
/assets/app.js: 049a6ce559c888a872c16056189e94b70d39048d1438950f4c820d17e9c0694e

Rule check

Every time the app opens it reproduces 25 worked examples and published figures: 26 CFR 1.148-3(j) Example 1 (credits, future values, rebate amounts at three computation dates and the payments, in the example's own whole-dollar arithmetic), the yields of 1.148-4 Examples 1 and 2, the future value factors of a published rebate report (yield 3.90084%), the computation-to-payment dates of a published rebate summary, and a 10th-year computation date (25/25 today).

Check	Published	Bondtally
1.148-3(j) Ex. 1: computation credits through 1/1/1999 (dates)	1995-01-01 1996-01-01 1997-01-01	1995-01-01 1996-01-01 1997-01-01	✓
1.148-3(j) Ex. 1: future value of the $49,000,000 payment at 1/1/1999	-69119339	-69119339	✓
1.148-3(j) Ex. 1: future value of the 2/1/1994 receipt	4207602	4207602	✓
1.148-3(j) Ex. 1: rebate amount at 1/1/1999	452432	452432	✓
1.148-3(j) Ex. 1: 90% installment paid	407189	407189	✓
1.148-3(j) Ex. 1: rebate amount at 1/1/2004	638200	638200	✓
1.148-3(j) Ex. 1: future value of the 1999 payment at 1/1/2004	574380	574380	✓
1.148-3(j) Ex. 1: additional payment at 1/1/2004	0	0	✓
1.148-3(j) Ex. 1: rebate amount at the final computation date 1/1/2009	899244	899244	✓
1.148-3(j) Ex. 1: future value of the 1999 payment at 1/1/2009	810220	810220	✓
1.148-3(j) Ex. 1: additional final payment	89024	89024	✓
1.148-3(j) Ex. 1: direct computation in cents at 1/1/2009, within $2	899244	899246	✓
1.148-4 Ex. 1: yield, no early call (percent)	5.8731	5.8731	✓
1.148-4 Ex. 2: yield, mandatory sinking fund 2001–2004 (percent)	5.8678	5.8678	✓
Rebate report, yield 3.90084%: factor 2025-07-31 to 2026-07-31	1.0393888	1.0393888	✓
Rebate report, yield 3.90084%: factor 2024-07-31 to 2026-07-31	1.0803291	1.0803291	✓
Rebate report, yield 3.90084%: factor 2023-07-31 to 2026-07-31	1.122882	1.122882	✓
Rebate report, yield 3.90084%: factor 2022-07-31 to 2026-07-31	1.167111	1.167111	✓
Rebate summary: computation date 2026-11-16 -> pay date	2027-01-15	2027-01-15	✓
Rebate summary: computation date 2027-11-15 -> pay date	2028-01-14	2028-01-14	✓
Rebate summary: computation date 2028-03-01 -> pay date	2028-05-01	2028-05-01	✓
Rebate summary: computation date 2029-12-15 -> pay date	2030-02-13	2030-02-13	✓
Rebate summary: computation date 2029-11-20 -> pay date	2030-01-21	2030-01-21	✓
Rebate summary: computation date 2030-12-01 -> pay date	2031-01-30	2031-01-30	✓
Rebate summary: 10th bond year computation date of an issue delivered 11/16/2016	2026-11-16	2026-11-16	✓

Sources: eCFR title 26, sections 1.148-3 and 1.148-4 (in force 1 October 2026); Government Capital Securities Corporation, arbitrage report for Baytown Township, MN, Series 2016A (August 2026, public board packet); Coastal Water Authority, FYE 2025 rebate summary (public). Read 30 October 2026.

Browser hardening

Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site and Paddle; framing blocked.
Every value read from your file is shown as text, never as HTML. Spreadsheet downloads neutralise formula-like cells. Your license key is kept in local storage and verified offline with an Ed25519 signature.

Sub-processors

Cloudflare: hosting of the static site and the license endpoints.
Paddle.com: merchant of record for payments, invoices, tax and refunds.

Contact

support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day.