How BOMShield handles your BOMs

This page describes the controls actually implemented in the product — not intentions — so you can decide, in full knowledge, what you entrust to us.

Last updated: 28 July 2026 · Scoring engine V2

Scope of use. BOMShield is a public geopolitical screening tool, not an accredited environment for sensitive data. Do not upload classified, export-controlled, or contractually confidential BOMs. For sensitive industrial use, let's talk about a private or on-premise deployment.
💾

Data & retention

  • Your BOM is parsed in memory and never written to disk; it is released as soon as the analysis is returned.
  • Results are not persisted by default — only if you explicitly enable versioning.
  • Saved analyses are encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256).
  • No "deleted on browser close" promise for saved versions: they stay until you purge them, in one click.
  • No account, no login, no ad tracking.
🔒

Transport & hosting

  • Encrypted transit over HTTPS / TLS.
  • Hosted on Render (EU / US regions). Hosting is not sovereign at this stage — an explicit point of the scope above.
⬆

Upload safety

  • Extension allowlist (.csv, .xlsx) and a 5 MB cap, checked before read (via Content-Length) and after.
  • Hard cap of 100,000 rows; bounded CSV field size.
  • XLSX zip-bomb guard: decompressed-size and compression-ratio limits before opening.
  • Billion laughs guard: dangerous XML directives (DOCTYPE/ENTITY) rejected.
🛡

Application hardening

  • Security headers on every response: Content-Security-Policy, HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (anti-clickjacking), Referrer-Policy, Permissions-Policy.
  • Origin check (anti-CSRF) on the destructive purge action.
💳

Payment (29 € PDF)

  • Payment via Stripe Checkout.
  • The Stripe webhook signature is verified with the endpoint secret against the raw body.
  • PDF delivery is gated server-side: only a verified paid session unlocks the report, with a per-purchase download cap. The client return page alone never unlocks it.
📝

Logs & privacy

  • We avoid writing BOM identifiers (part numbers) and personal data (emails, keys) to application logs — these are redacted.
🤝

Subprocessors

  • Render — application hosting.
  • Stripe — PDF report payments.
  • Live distributor data (Nexar / Octopart) is used only on paid "live" plans, currently frozen: the free tool makes no paid external API calls.
⚖

Scope & limitations

  • A screening aid — not legal / export-compliance advice, not part-level ITAR/EAR classification.
  • Country signals reflect the manufacturer's known footprint and standard routes — not the confirmed origin or actual shipping lane of the specific part.
  • Not an accredited (e.g. SecNumCloud) environment. For sensitive data, a private or on-premise deployment is the right path.
📩

Responsible disclosure

Found a vulnerability or a data-handling concern? Email selisabeth@genesis-retrotech.fr. We handle good-faith reports without legal action.