Skip to content
Request Demo
OXXON Advisors — Data Handling

Workbook Processing & Privacy

Every uploaded workbook follows the same deterministic processing pipeline. No AI inference. No cloud storage. No account required.

Every audit follows the same deterministic processing pipeline. Workbook contents do not alter how the engine behaves beyond the structural characteristics being analysed. No AI inference. No probabilistic decisions. Every workbook is evaluated using the same codified methodology.

Processing pipeline

Eight stages, applied to every audit in sequence.

  1. Stage 1

    Workbook Upload

    Model received and written to temporary storage.

  2. Stage 2

    Temporary Processing

    Audit pipeline runs in server memory.

  3. Stage 3

    Workbook Analysis

    Sheet structure, cells, and formulas parsed into memory.

  4. Stage 4

    Structural Validation

    Deterministic controls applied to the model.

  5. Stage 5

    Risk Assessment

    Score and letter grade computed.

  6. Stage 6

    Audit Report Generation

    Audit memo written to temporary file.

  7. Stage 7

    Download

    Memo delivered to your browser.

  8. Stage 8

    Automatic Deletion Attempt

    Application attempts to delete all temporary files.

Security & Privacy

What the application does and does not do

Six verifiable statements about how your workbook is handled, derived from direct inspection of the application code.

No Cloud Storage

Uploaded workbooks are not transmitted to or stored in cloud object storage. No cloud storage library is present in the application or its dependencies.

No AI Inference

No third-party AI or large language model service is called during processing. Audit findings are produced by deterministic structural rules applied to the workbook's formula structure.

No Database Storage

Uploaded workbooks are not written to an application database. No database driver is present in the application or its dependencies.

No Third-Party Services

The application code makes no external file transmissions and calls no third-party API during processing. Infrastructure-level behaviour — such as platform logging or TLS termination — is outside the scope of the application code.

Temporary Processing Only

Uploaded workbooks are processed in temporary application storage during audit generation. No workbook data is written to a permanent storage location by the application.

Automatic Deletion Attempted

The application attempts to delete all temporary files on completion of every audit, including on error paths. Individual deletion failures are caught silently and are not retried or separately logged.

All statements above are derived from direct inspection of the application code. Statements 4 and 6 reflect application-level observations; platform infrastructure behaviour is outside the scope of this assessment.

Technical explanation

Each stage in detail

What happens

Your Excel workbook is received by the application and written to a temporary file in the server's OS temporary directory. The application immediately begins the audit pipeline with the file at this temporary path. All processing occurs synchronously within the same HTTP request — no background queues or deferred processing are used.

What does not happen

The file is not stored in an application database, uploaded to cloud object storage, or transmitted to any third-party service. Workbook contents are not written to application logs.

Data retained

The workbook exists as a temporary file on the server filesystem for the duration of the audit request.

Approximate duration

Near-instantaneous once received. Upload time depends on file size and your connection speed.

What happens

The uploaded workbook file is held in the server's OS temporary directory while the full audit pipeline runs. All stages — parsing, analysis, validation, scoring, and report generation — execute synchronously within the same request lifecycle.

What does not happen

No workbook data is transmitted externally at any stage. No workbook contents are written to application logs. The workbook is not stored in any persistent application storage location.

Data retained

The temporary file in the OS temporary directory.

Approximate duration

The full audit pipeline — typically under 30 seconds for most workbooks, depending on workbook size and formula complexity.

What happens

The application reads the workbook's sheet structure, cell contents, and formulas into memory for analysis. It then traces how formulas reference other cells to build a complete map of the model's logical structure.

What does not happen

No data leaves the server. No AI model reads or processes the content at any point in this stage.

Data retained

The parsed structure and dependency map exist in server memory during the audit.

Approximate duration

Typically under 10 seconds combined, depending on workbook size and formula complexity.

What happens

The audit engine applies each structural control to the workbook's parsed data. Each control evaluates a specific structural condition — such as circular references, formula inconsistencies, or hardcoded values in formula chains — and produces a finding where the condition is met. The same workbook always produces the same findings. No control involves inference, probability, or AI.

What does not happen

No workbook data is transmitted externally. No AI model is consulted. No finding is produced by pattern recognition or probabilistic reasoning.

Data retained

Findings are held in server memory for the duration of the audit.

Approximate duration

Typically under 5 seconds for most workbooks.

What happens

Each finding is assigned a severity-based weight and the weights are aggregated into a numeric risk score from 0 to 100 and a letter grade from A to F. Critical findings trigger a grade override regardless of the numeric score.

What does not happen

No external service is called. Risk scoring is performed entirely in server memory using the findings from the previous stage. No AI estimation is used.

Data retained

The risk score and letter grade are held in server memory.

Approximate duration

Near-instantaneous.

What happens

A structured audit memo is generated from the findings, risk score, and workbook metadata. The memo is written to a temporary file on the server filesystem. If PDF conversion is available on the server, the memo is converted to PDF; otherwise the DOCX is returned.

What does not happen

The memo is not stored in a database or transmitted to any external service. No workbook contents beyond the structural findings identified by the rules are included in the memo.

Data retained

The generated report file is held as a temporary file on the server filesystem until the audit response is assembled.

Approximate duration

Typically under 10 seconds.

What happens

The generated report is transmitted to your browser over the same encrypted connection used for upload.

What does not happen

The report is not stored anywhere beyond the temporary location used to serve it to you.

Data retained

None beyond the temporary file, which is removed in the next stage.

Approximate duration

Near-instantaneous once generation completes.

What happens

On completion of every audit — whether successful, failed, or timed out — the application's cleanup block attempts to delete all temporary files created during the request: the uploaded workbook, the DOCX report, and the PDF file if one was generated. Deletion is attempted unconditionally across all code paths.

What does not happen

The application does not verify that deletion succeeded. If a deletion fails — for example due to a file lock or permissions error — the failure is caught silently: no log entry is written, no retry is attempted, and no alert is raised. If the server process is terminated abruptly by a worker timeout, the cleanup block may not run and temporary files may remain on the server filesystem until the container restarts.

Data retained

In normal operation, no temporary files remain after this stage completes. The exception is a silent deletion failure or a process-level timeout that bypasses the cleanup block.

Approximate duration

Near-instantaneous.

Questions

Frequently asked

No. The application writes uploaded workbooks to the server's OS temporary directory and attempts to delete the file at the end of every audit. There is no application database and no cloud object storage in the system. The application does not retain workbook files after processing completes, though a silent deletion failure or an abrupt process termination may leave a temporary file on the container filesystem until it restarts.

No person manually reviews uploaded workbooks. The audit is fully automated. Workbook contents — cell data, formula values, and sheet structure — are never written to application logs and are not accessible to OXXON Advisors personnel through any application-level mechanism. The original filename does appear in server error logs when an audit fails.

No. The audit engine uses deterministic structural rules applied directly to the workbook's parsed data. No AI, large language model, or probabilistic inference is used at any stage. No third-party AI service is called during or after processing. The same workbook produces the same findings every time.

The application attempts to delete the uploaded workbook file at the end of every audit. In normal operation, deletion is attempted before the response is returned to your browser. However, the application does not confirm that deletion succeeded. If deletion fails silently or if the server process is terminated abruptly, the temporary file may remain on the container filesystem until the container restarts. The application has no mechanism to retrieve or access previously uploaded workbooks.

If an error occurs at any stage, the application still attempts to delete all temporary files created up to that point, including the uploaded workbook. An error-level log entry is written with a request identifier, the stage where the failure occurred, and the exception type — but not workbook contents. The application returns a generic error message to your browser.

The application logs operational metadata only: a request identifier, processing stage names, and exception types when an error occurs. The original filename appears in error-level log entries when an audit fails. Workbook contents, cell data, formula values, and sheet structure are never written to application logs.

The application code makes no external transmissions of workbook data. No cloud storage library, database driver, or third-party API client is present in the application. The audit report is transmitted to your browser as the intended output of the audit — this is not a third-party data transfer. The application does not control infrastructure-level behaviour such as platform logging or TLS termination; this assessment applies to the application code only.

Ready to audit your model? No account required — upload any .xlsx file and receive results in under 30 seconds.

Run a structural audit See the run lifecycle
Request Demo