Security

What we do to earn
access to your data.

Last updated 15 August 2026

We build software for warehouse, production and supply chain teams, which means we are asking to be trusted with part numbers, orders, suppliers, costs and occasionally people. This page sets out how that trust is earned — what the software does and doesn't do, what gets checked before a release, and exactly what happens to your data if you send us any.

It also sets out what we don't have. If your procurement process needs a certification we haven't got, that's better established on this page than three weeks into a project.

Nobody can honestly promise software is 100% safe.

Anyone who tells you their software is unbreakable is telling you they haven't looked hard enough. What we can promise is a small attack surface, a written list of what we check, an honest account of what we found, and a habit of publishing the limits rather than hiding them.

The short version

Our tools run on your machine, not ours. The free tools run entirely in your browser. MDReady runs as a desktop application with no network code in it at all. Your data doesn't travel to us, because there is nowhere for it to travel to.
We'd rather not hold your data. Most of our work needs the shape of your data — field names, formats, rules — not the contents. Where we genuinely need real records, we agree that in writing first, take the least we can work with, and delete it when we're done.
Every release is reviewed against a written checklist. It is our own review, not a third party's. The checklist and the findings are published below, including the things it caught.
You don't have to take our word for the offline claim. There are instructions further down for proving it yourself in about two minutes.

How the software is built

It doesn't call home

Our tools contain no analytics, no telemetry, no crash reporting, no licence check and no update check. This isn't a setting you have to find and switch off — the code to do those things does not exist in them. MDReady, our SAP material master checker, has no HTTP client anywhere in its source.

Small, boring dependencies

Every third-party library is a door into your business that somebody else holds a key to. We use as few as we can, prefer widely-used and actively maintained ones, and read what they do with untrusted input before adopting them. MDReady has two.

Least privilege by default

Our desktop software installs into your own user profile and needs no administrator rights. It installs no services, no scheduled tasks and no drivers, and changes no system settings. Uninstalling removes it completely. If a tool needs to listen on a network port, it listens on the loopback address only — your own machine, unreachable from your network — and that restriction is enforced in code rather than merely intended.

Your data stays in memory

MDReady reads your export, analyses it, and shows you the result. It writes nothing to disk unless you press the button that exports a PDF and choose where to put it. Close the window and the analysis is gone: no database, no cache of your part numbers, no history.

What gets checked before a release

Every release is reviewed against the same list. This is an internal review carried out by us — it is not a third-party penetration test, and we don't describe it as one.

Untrusted input. Every path a customer file takes through the code, including malformed and deliberately hostile files.
XML and archive handling. External entity attacks, entity expansion, and archive paths that try to escape their directory.
Injection. Anywhere input could reach a database query, a shell command, or a file path.
Output encoding. Anywhere data from a file is rendered back to a screen or a document.
Network egress. Confirmed to be none, rather than assumed to be none.
Local attack surface. Ports opened, what may connect to them, and what a malicious page in another window could reach.
Secrets. No credentials, keys or tokens in source or in shipped files.
Privilege. Nothing that needs admin rights, and nothing that quietly persists.

Review log

Findings are published whether or not they are flattering. A review that never finds anything is a review that isn't happening.

These are found before a release, not after one. Nothing below ever reached a customer — the review is what a version has to pass to become a release in the first place. None of it concerns the file you put into the tool: reading your export has never been the risky part, and there is a separate note about that below.

Release	Reviewed	Found, and fixed before release
MDReady v1.01.00	15 Aug 2026	Two issues, both fixed. The local server accepted connections from any origin, so a page on another website could have opened a session against it; it now refuses anything that didn't come from itself, which also defeats DNS rebinding. An environment variable could override the loopback restriction and expose the analysis server to the network; non-loopback values are now ignored. Tested and clean: a crafted spreadsheet carrying a hostile external XML entity does not make the application contact anything — verified against a listener we controlled, with a control request to prove the test itself worked.

Is opening a file in it risky?

No — and it is worth being clear about why, because it is the question people actually want answered.

Your export is read into memory, checked, and shown back to you. It is not uploaded, not written to disk, and not kept. The only file MDReady ever writes is the PDF you ask it for. A spreadsheet cannot make the application contact anything — we tested that specifically, with a file built to try.

The things our review looks for are different: whether some other program or web page on the same computer could interfere with the tool while it runs. That is a normal thing to check for any software that opens a port on your machine, and it is checked before a version is ever released.

Prove the offline claim yourself

This is the claim everything else rests on, so don't believe it on our say-so. With MDReady installed:

Disconnect from the network — pull the cable out, turn off Wi-Fi, or both.
Open MDReady and run a real export through it, start to finish.
Export the PDF report.

Everything works exactly as it does online, because nothing in it was ever using the network. If your IT team would rather watch the traffic than the cable, the application can be run behind a firewall rule that blocks it outbound entirely, and nothing will change.

For your IT team

Happy to answer a security questionnaire, walk someone through what the software does, or sit on a call with whoever has to sign it off. That's a normal request and we'd rather have the conversation early than have a project stall at the approval stage.

Your data when we work together

We ask for as little as possible

Most questions can be answered with a field list, a screenshot with the values blanked, or twenty made-up rows in the right shape. We start there. Real production data is a last resort, not an opening request.

If we do need real data

In writing first. What we need, why, for how long, and what happens to it afterwards — agreed before anything is sent.
The minimum that works. An extract, not a database. The columns in question, not every column. Sensitive fields removed or masked where they aren't needed.
Under your NDA if you have one. Send it and we'll sign it before we see anything. If you don't have one, we'll provide a short mutual one.
Deleted when the work ends. Within 30 days of completion, and we confirm the deletion in writing. If you want it sooner, say so and it goes sooner.
Never reused. Your data is not used to build anything for anyone else, and never becomes a demo.

Where it lives while we hold it

On encrypted devices, in the United Kingdom, with the operating system's full-disk encryption on and automatic screen locking enabled.
Behind multi-factor authentication on every account that touches it.
Not copied to personal devices, personal email or removable drives.
Not pasted into third-party services, including AI assistants. We build with modern tooling and are open about that — but your production records are not what goes into it. Code, data structures and invented sample rows are.

Who else is involved

We keep the list short deliberately, and it is the whole list:

Cloudflare — hosts this website and routes our email. Email addresses submitted through the free tools are stored here.
Google — our email. Correspondence you send us lives in a mailbox.
GitHub — where our source code is kept, in private repositories. Customer data is never committed to a repository.

This website itself loads nothing from anywhere else. No analytics, no tracking pixels, no advertising, no cookie banner, and the fonts are served from this domain rather than a font service — so reading this page tells no other company that you were here. What we collect and why is in the privacy notice.

If something goes wrong

Reporting a vulnerability

If you think you've found a security problem in anything we've built, please tell us: rodrigo@burlesystems.co.uk

We'll acknowledge within two working days.
We'll tell you what we intend to do about it, and when it's fixed.
We will not take legal action against anyone who reports a genuine issue in good faith and doesn't exploit it, access data that isn't theirs, or go public before we've had a fair chance to fix it.
You'll be credited in the release notes if you'd like to be.

If your data were ever exposed

You would hear it from us within 24 hours of us becoming aware, by phone and in writing: what happened, what data was involved, what we've done, and what we recommend you do. Not a carefully-worded notice three weeks later. Where the law requires the Information Commissioner's Office to be told, we tell them.

What we don't have

Being straight about this is the point of the page.

No ISO 27001 or SOC 2 certification. These are meaningful standards and we don't hold them. If your policy requires a certified supplier, we are not currently a fit, and we'd rather say so now.
No third-party penetration test. The review described above is our own. It is thorough and it is documented, but it is not independent, and we won't call it an audit.
Our installers are not code-signed yet. Windows SmartScreen will warn you the first time you run one. That warning is legitimate and you are right to take it seriously — a signing certificate is on the list, and until it's bought we say so in the installer itself rather than talking you past it.
We are small. There is no 24/7 security operations centre here. What there is instead is a very small amount of software, doing a very small number of things, on your own hardware.

The honest summary

The strongest security control we have isn't a certificate. It's that our software mostly doesn't hold your data, doesn't transmit your data, and doesn't need a server to do its job. Most of the ways this could go wrong have been designed out rather than defended against.

Questions

If there's something here you'd want to challenge, or a questionnaire you need filled in, write to rodrigo@burlesystems.co.uk and you'll get a straight answer, including "we don't do that" where that's the answer.