Not a filing
Not a filing receipt, not a compliance determination, not regulator approval. Production filings must still pass FINTRAC.
Does this file or store reports on a server?
Free checks do not file and do not upload. Pro Save run (explicit) stores the checked report or scan in your entity workspace under your account. This is not a FINTRAC, FinCEN, or AUSTRAC system. It is not legal advice.
Report data
Check one, Batch check, Scan transactions, Scan clients, and the reject decoder run in this tab for free. Filing deadline helper stays in this browser’s localStorage. The Reject log stays in IndexedDB — file hashes, finding counts, and statuses you type, not the report body. Your region choice is stored as amldeck.region. A purchase email you type to unlock paid downloads stays in this browser. What you paste or load on Check one or Batch check lives in memory for this tab unless you choose Pro Save run. Scan Clients has no cloud Save run.
Other network activity
Notify me on paid-plan screens, Contact, Feedback, and pack-change alerts on Rule packs send the email and message you type to Formspree — never a free-check report. Pack-change alerts are a subscriber list only; this app does not email people when a pack version changes. Page views go to Vercel Analytics (query strings stripped); Speed Insights measures load time. Check one, Batch check, and Reject log call our license API with a stored purchase email, if any. Stripe Checkout is not open. Unlock is the purchase email plus a live Stripe lookup — not a signed license token. Anyone who knows a paying email can unlock paid features.
How to verify
Open DevTools → Network during a free Check one run or a scan. The report payload is not POSTed. License lookup (/api/v1/license) appears on Check one, Batch check, and Reject log when those screens check a stored purchase email. Analytics and Speed Insights requests appear on page views. Pro Save run is an explicit upload after you confirm — not a silent background post. This is not a zero-XHR product.
Browser / transport hardening
Every route sets Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (DENY), X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Document routes also set CDN-Cache-Control and Vercel-CDN-Cache-Control to public, max-age=0, must-revalidate so a new deploy is not served from a stale HTML shell.
PII on screen
Names, dates of birth, addresses, and identifiers display as [MASKED]. Checks still use the in-memory original on your machine. We do not run free-text identifier scanners.
How to wipe
Clear this site’s data in the browser to remove device-local copies. Pro saved runs can be deleted from the entity workspace (cloud copy only). On a shared or public PC, clear site data before you leave.