Your case data stays on your computer.

Each case is a folder on your computer or your firm’s network. It holds the case database, the original evidence files exactly as received, exports and a hash manifest. Files are read directly from disk. There is no upload step, and no vendor-hosted service relays your case data.

• Lupalytics does not send case data, file names, client names, user names or results to us or to anyone else.
• Every evidence file is hashed with SHA-256 and logged in the chain of custody. Social Security numbers, bank account numbers and card numbers are hashed for matching and shown only as their last four digits.
• The desktop application talks to itself over a local-only address, protected by a token created at each launch. It does not open your computer to the network.
• The data on your computer is only as secure as your computer. We recommend disk encryption such as BitLocker.

The Demo opens a sample case built from demo data. It cannot import data, run tests or export. It contains no license activation, no update check, no REST API and no source-system connectors. It installs for your user only, as a separate product with its own data folder.

The installer may download Microsoft’s WebView2 runtime if your computer does not already have it.

These parts of the paid editions are still being built. This section describes the design and will be updated as each part is released.

• License activation. When you activate a license, the application sends our activation service your license key, a fingerprint of your computer and Windows account (a one-way hash, so we never receive your machine identifier), your Windows account name (licenses are per named user) and the application version. Nothing about your cases is ever sent. The service returns a signed license file that is checked on your computer, and it is refreshed about every 30 days. Our service records the license ID, fingerprint, account name, version and time of each activation, refresh and deactivation, and nothing else about your computer.
• Update checks. The application checks for updates when it starts and about every 12 hours while it runs. The request carries only the installed version, the release channel and a random installation ID, with no case data, file names or user names. Updates download in the background and are applied the next time you start the application. They are never applied during a test run, import or report, and they never change the results or settings of an existing case.
• Firm-hosted updates. A firm that does not allow its computers to reach our update host can mirror the update feed on its own network.
• If a subscription lapses, your existing cases stay readable, reportable and exportable. You are never locked out of a case.

Desktop Advanced and Server can extract data directly from your client’s accounting system, read-only. QuickBooks Online comes first. Credentials and other secret settings are encrypted on your computer, are never stored in a case or an archive, and are not shown again after you save them. Each extraction is saved as evidence and checked against the system’s own trial balance. No vendor-hosted service relays the data or holds connector credentials.

In the desktop edition the REST API is off by default, listens only on the local machine and requires API keys that you create and can revoke. Every change made through the API is recorded in the audit log under the key’s name.

• Waitlist and demo requests. If you join the waitlist or request the demo, we collect what you enter: name, work email, phone, firm and website, role, credentials and why you are interested. We use it only to review your request and to contact you about Lupalytics. It is stored on our own server and is not sold or shared. For demo requests we also record the time, IP address, country and browser of each demo download against your request, to manage your download link.
• Email. Our email is handled by Google Workspace.
• Cloudflare. The site is delivered through Cloudflare, which processes visitor requests, including IP addresses, to deliver and protect it. The demo request form uses Cloudflare Turnstile to block automated submissions, and Turnstile may set its own cookie.
• No trackers. This site uses no advertising or analytics trackers, and its ordinary pages set no cookies.
• Your information. To see, correct or delete what you gave us, write to [email protected].

Lupalytics is made by Sems & Associates Limited, 13500 Pearl Road, Suite 139-324, Strongsville, Ohio 44136. Questions about privacy: [email protected].

Last updated October 18, 2026.