Selmion: data and security statement
1. Where the data is kept
In the browser's local storage on that computer, for that browser profile. Nothing is stored on a server.
| What | How long |
|---|---|
| Progress on a delivery (ticks, quantities, notes, conditions, register ticks) | 30 days, then removed |
| Recent deliveries (the lines of the file, so a delivery can be reopened) | 30 days, then removed |
| Settings, supplier and customer list, corrections, remembered column layouts | Until cleared or replaced |
| Contents of a licence file loaded by hand, and the evaluation start date. A licence built into the tool file stays in the file. | Until the browser's site data is cleared |
| User names (the sign-in list) | Until the browser's site data is cleared. There is no control to remove a single name. |
| The record of agreement to the terms of use (version, time and user name, last 20) | Until the browser's site data is cleared |
| The activity record (section 4) | About 30 days, then removed |
2. What leaves the computer
Nothing leaves automatically. Selmion has no telemetry, no analytics and no update check. A person can choose to send something out:
- Copy message and Open in email app: the report to the supplier or customer is put on the clipboard, or opened in the computer's own email program. The person reads it and sends it.
- Export CSV, Export setup and Print: files and paper the person keeps.
- Report a problem: opens an email or saves a file. It contains the version, the licence line (licensee name and dates), the browser, the screen size, the category, the description typed, the result of the last PDF read, recent program error messages and, if ticked, the file name, the sheet names and the column headings. It does not contain the lines of the delivery. If the heading row of a file was not recognised, the headings shown may themselves be data, so the whole report can be read on screen before it is sent. A screenshot, if the person attaches one to the email, is outside Selmion.
- File reading report: prepared when a file cannot be read after three attempts, or on request. By default it contains the version, the licence line, the browser, the file type and size, the number of failed reads, the reading problems by position, and the layout without headings or lines. If the person ticks the box to include the lines, it also contains the file name and up to the first 40 lines of the file as read, which can include medicine names, quantities and supplier details. Nothing is sent unless a person chooses to send it, and the whole report can be read on screen first.
3. Technical controls
- A content security policy in the file forbids network requests, forms, frames, workers, plug-ins and external resources. It allows only the scripts in the file itself, each identified by a cryptographic hash, so markup injected into the page cannot run as script.
- A build-time audit reads the application code and refuses to build the file if it finds a network call, a web address, a form, a link to anywhere but a file the page made itself, or a navigation other than the two email links. It also reads the finished file and refuses it if the policy is missing, in the wrong place, or does not match the scripts. The audit is textual; the policy and the tests below are what back it up.
- Tests run before each release attempt each outbound route from inside the page (requests, sockets, beacons, frames, forms, workers, injected scripts and event handlers, stylesheet and font loads, evaluation of text as code) and require the browser to refuse every one. They also use every output feature and require that no request and no policy violation results.
- The spreadsheet and PDF readers are bundled inside the file, and their file hashes are pinned in the build. Nothing is downloaded when it runs.
- Text from a supplier's file, an imported setup file and saved progress is checked as it comes in and is always shown as text. It is never run as page code. This is checked by automated tests with hostile contents.
- A licence file is checked offline against a public key built into the file (ECDSA P-256 signature). The licence names the licensee and its dates; it contains no customer data.
4. The activity record
Each user signs in with a name and agrees to the terms of use, which describe the record. It holds the user name, the date and time and the control used (for example "ticked" or "printed"). It never holds medicine names, quantities, supplier details or typed notes. Entries are deleted after about 30 days. It is stored on the same computer in encrypted form, and is designed to be opened only with the administrator key, which the seller holds. The customer cannot read it. The seller reads it only to diagnose a fault in Selmion or a dispute between the seller and the customer about its use, only when the customer has agreed to this by email and the computer concerned is made available, and keeps no copy unless the customer agrees in writing.
5. Third-party components
SheetJS Community Edition 0.18.5 and PDF.js 3.11.174, both under the Apache License 2.0. The notices and licence text are in THIRD_PARTY_NOTICES.txt, supplied with the file.
6. Limits to know about
- A file cannot stop everything on the computer. Other programs, browser extensions, and browser features such as spell check, translation and autofill are outside what a web page can control. Use a dedicated browser profile for Selmion with no extensions you do not trust.
- Other pages opened from disk can see this storage. In Chrome and Edge, pages opened from the computer's disk in the same browser profile share storage. Another HTML file opened in the same profile could read what Selmion keeps. Open only files you trust in that profile, or keep a separate profile for Selmion.
- Browser storage is not a database. Clearing the browser's site data, or a browser set to clear data on exit, removes progress, settings and any licence loaded from a file (a licence built into the tool file is kept). Keep the licence file and use Export setup.
- Per computer, per browser. Another computer or another browser starts empty. Nothing is shared between computers.
- Not tamper-proof. A person with access to the computer's browser profile can read or change what is stored. Keep the printed delivery record and the exported CSV as the durable record.
- Not a validated system of record. Selmion is a checking aid. It does not replace the controlled drug register, the supplier's documents, or a validated warehouse system.
- Supported browsers: a current Microsoft Edge or Google Chrome.
7. Updating
Replace the Selmion file in the same folder and open it in the same browser. Settings, lists and the licence are kept. A renewed licence file is dropped onto the start screen.
8. A security concern
Write to the support address shown in the Licence panel. Please do not include patient or personal data in the message.
This statement describes version v39 and later. Controls described here are those in the file; it is not a certification.