Where your data goes
The short answer is nowhere. The diagnostic runs entirely in your browser: there is no database, no server-side application and no account, so there is no place for your answers to be stored. That is not a policy you have to believe. It is how the thing is built, and you can check it in about a minute.
What happens to what you type
The concern is not really a data-protection one. The input here is your own list of unclosed control gaps before a listing — commercially, the most sensitive document in the building. The product is shaped around that.
- Your answers never leave the tab. The questionnaire, the contradiction engine, the priority ranking and the report are all code running on your machine.
- There is nowhere to send them. The application has no API routes. There is no address your answers could be posted to, by accident or otherwise.
- Nothing is saved, even locally. No cookies, no browser storage. Close the tab and the answers are gone — from us, and from your own machine.
- The PDF and the Excel workbook are built here. Both are assembled in the tab from what is on screen and go straight to your downloads folder. Neither passes through a rendering service.
- And a workbook you open again is read here too. The scan can take back an Excel export you have worked in, so you do not answer everything twice — it is read in the tab, like the PDF is written in it. Nothing is uploaded, which is also why the progress you track lives in your file rather than in an account here.
- The sanctions check runs on your side. The published UK Sanctions List is downloaded into your browser once, and the name comparison happens there. Director and shareholder names are not sent anywhere.
- Your browser is instructed to refuse anything else. Every page is served with a Content-Security-Policy whose connect-src names two destinations: this site, and the public GLEIF API below. Your browser enforces that, not us.
The one exception, named by us
Exactly one feature opens a connection: the group perimeter check against GLEIF, the public global register of legal entity identifiers. The boundary is drawn narrowly and enforced in code rather than described in prose.
The LEI. Twenty public characters, already printed in your own filings and searchable by anyone at gleif.org.
The entity names you declared, every scan answer, the gap list. The group comes back from GLEIF, and the comparison is made here.
The lookup fires from a button, never from typing — a field that searched as you typed would send an identifier you had not chosen to send. The identifier’s check digits are validated locally, so a typo never reaches a third party. And if you would rather not send even that, skip this one check: all 73 criteria and the other two register checks work without it.
How to check all of that without asking us
Any claim of this kind is worth what it can be tested against. Four tests, in increasing order of thoroughness. The first two need nothing from us.
- Turn the internet off, then keep working.Load the scan, switch on airplane mode, and complete it — including downloading the PDF. It all still works. Something that runs with the network off is not sending anything anywhere, and the test takes a minute.
- Watch the network tab.Your own IT team can open the browser developer tools and see every outbound request the page makes, live. Fill the questionnaire in front of them: no request carrying answers appears, because there is no route for one.
- Read the response headers.curl -I against this site prints the Content-Security-Policy. The list of destinations the page is permitted to contact is two entries long. That is an enforced restriction, not an intention.
- Audit it, or take it in-house.Run your own front-end review, or ask for the offline package and put it inside your own network. We will also give a written confirmation of non-retention as an annex to an NDA.
We do not store your answers — not because we have undertaken not to, but because there is physically nowhere to put them. No database, no server-side application, no accounts. The consequence is the useful part: we never become a processor of your data at all, so there is no data-processing agreement to negotiate, no vendor assessment to run on us, and nothing about our internal procedures you have to take on trust.
“We are not allowed to” is a promise. “There is nowhere to” is a fact — and one you can confirm in two minutes.
Using it without naming your company
You already can, and nothing needs to be arranged. The questionnaire never asks who you are: there is no company name field, no registration and no email. Run all 15 free criteria — or all 73 — without identifying yourself, and we still see neither your answers nor the fact that you ran it.
It is worth saying that checking sanctions lists by hand is the less private option, not the more private one. Doing it manually means typing director and shareholder names into somebody else’s search box — which is an outbound request carrying identifiable names. Here the list comes to you and the comparison happens on your machine. It also catches transliteration variants, which is where manual checking reliably fails for this population: one designated individual can appear under four different spellings.
There is exactly one page that does ask who you are, and it is the order step — because an invoice needs a company name on it. It submits nothing either: the fields compose a message and hand it to your own mail client, and there is no code path by which anything from a scan could be folded into it. You can also ignore the page and simply write to us.
It can only ever find something. It never clears anyone: no match is not the same as no designation, and we say so on the check itself rather than in small print. A match is not an identification either — it has to be resolved against date of birth, nationality and passport before it means anything.
Running it inside your own network
The site is static, with no database and no server-side logic, so it can be handed over as a folder of files: put it on an internal web server, or open it from removable media inside an isolated environment. Everything works except the GLEIF lookup, which needs the internet. The criteria and the sanctions index travel inside the package.
Two things we say before agreeing to it rather than after. The package carries the intellectual property — 73 criteria mapped to ICAEW objectives and UK Listing Rules, the dependency logic, the ranking — so it goes out under a contract that limits purpose and term. And updates stop arriving on their own: listing rules move and designations are added constantly, so it needs an agreed refresh routine or you are working from a stale copy without knowing it. For most people the tests above settle the question more cheaply.
Full disclosure
This site runs cookieless traffic analytics: page, country, referrer. Form contents are not collected and could not be — they never reach a server. We mention it unprompted because the alternative is your security team discovering it after we said we collect nothing, and that costs more than the fact itself is worth.
The paid diagnostic sits behind a password issued with a piece of work rather than by signing up; what it contains and how access is granted is on the diagnostic page. How access is granted makes no difference to any of the above: your answers do not leave your machine either way.
Any of the register checks can be demonstrated live, on public data, without a single document of yours — so the question is settled before you type anything.
Rules checked through 2026-09-11