Your data never leaves your device.
Rate Studio runs entirely in your browser and saves your work to a file you control — no server, no cloud, no transmission of your financial data. Here's exactly how that works, and what it means for your compliance obligations.
A single file, running entirely on your device.
Understanding the tool's architecture is the foundation of understanding its security posture. The design is intentionally simple and deliberately offline.
Browser-based, locally executed
A single HTML file containing all application logic. Open it in Chrome, Edge, Firefox, or Safari and the browser runs everything locally — no internet connection required after the initial download, no data transmitted anywhere.
Local storage — a JSON file you control
Your configuration and cost data export to a JSON file at a location you choose. No database, no cloud storage, no session server, no automatic sync — the file is managed under your organization's existing document security policies.
No server-side components
No API, no backend database, no authentication server, no logging infrastructure. The membership plugin controls access to the download page only — it has no visibility into the tool's operation or your data once you're using it.
Why FedRAMP doesn't apply.
FedRAMP is the standard framework for cloud services used by or on behalf of federal agencies. This tool isn't a cloud service, so it falls outside FedRAMP's scope.
No cloud hosting of user data
The tool does not host, store, or process user data on any server. Data exists only on the user's local device or network.
No federal agency relationship
FedRAMP obligations attach to vendors serving federal agencies. This tool is sold to government contractors for their internal business use — not to federal agencies.
No transmission of federal information
The tool processes contractor-generated financial data. It does not transmit this data anywhere, and the data itself is not federal government information.
No cloud service boundary
FedRAMP requires authorization of the cloud system boundary — the servers and infrastructure that make up the service. This tool has no such boundary; the execution boundary is the user's browser on the user's device.
In plain terms: FedRAMP governs where federal data lives in the cloud. This tool keeps your data on your computer.
Why CUI requirements don't apply to this tool.
Controlled Unclassified Information (CUI) requires safeguarding under federal law for contractors handling it under contracts with CUI clauses — typically DFARS 252.204-7012 for DoD contracts or FAR 52.240-7 for civilian agency contracts. Contractor-generated internal business information is not CUI — it's your own proprietary business data.
What this tool processes:
- Labor cost pool allocations and indirect rates
- Payroll and fringe benefit cost totals
- General ledger account balances and trial balance data
- Indirect cost pool structures and allocation bases
- Contract cost summaries (cost elements, not contract deliverables or technical data)
- Incurred cost proposal schedules required by FAR 52.216-7
None of this is CUI as defined by NARA's CUI Registry or any agency-specific designation — it's the contractor's own financial records. CUI obligations are contract-specific: if your contracts include CUI clauses, those obligations govern the information specified in those contracts, not your internal accounting tools.
Genuinely sensitive data, protected under your own policies.
While CUI and FedRAMP requirements don't apply, the data you work with — indirect rates, pool structures, payroll totals — is competitively sensitive and warrants real protection. Because the tool operates entirely within your environment, you control every aspect of that protection.
Device security
The computer running the tool should be subject to your organization's endpoint security policies — antivirus, full-disk encryption, screen lock, and patch management.
File storage
JSON files should be stored on drives or network shares covered by your access control policies — the same restrictions you'd apply to any sensitive financial file.
File encryption
If your organization requires encryption at rest, apply that requirement to the JSON files. BitLocker, FileVault, or encrypted network storage satisfy this with no changes to the tool itself.
Backup and retention
JSON files should be backed up and retained per your document retention policies. Incurred cost proposals may be audited years after submission — retain accordingly.
Access controls
Limit access to saved JSON files to personnel with a legitimate need to view or edit the cost data. Your existing network and file permission systems handle this at the infrastructure level.
Sharing
Use your organization's secure file transfer methods — encrypted email, secure file sharing, or encrypted physical media — rather than unprotected email attachments.
Local execution was a decision, not a limitation.
For financial and compliance tools used by government contractors, keeping data within your own environment is the most defensible security posture available.
No external attack surface
There's no server holding your data that could be breached, ransomed, or subpoenaed. The attack surface is your device — already within your security perimeter.
No vendor data exposure
We never see your cost data. We cannot accidentally expose it, misuse it, or be required to produce it in response to a legal process directed at us.
No third-party compliance dependency
Your data security compliance (NIST 800-171, CMMC, organizational policy) does not depend on our security controls. You don't need to assess us as a third-party risk.
No breach notification risk
Because we hold no user data, a compromise of our hosting infrastructure cannot expose your financial information. There is nothing to breach.
Works in air-gapped environments
The tool runs on networks with no internet access, on government-furnished equipment, or anywhere external software connections are restricted.
Audit trail under your control
All versions of your analysis exist as files in your own document management system, with whatever version control and access logging your organization maintains.
The hosting layer — what it does and doesn't touch
Access to the tool is managed through a WordPress-based membership platform, handling login, membership tier, and payment only.
- User credentials (email and hashed password) are stored by the membership platform per standard web application security practices.
- Payment is handled by Stripe, a PCI DSS-compliant processor. We do not store payment card data.
- The membership platform has no access to any data you enter into the tool after you download and open the HTML file.
- Your login session authenticates access to the download page only — it has no connection to your analysis data or saved JSON files.
- HTTPS encryption is used for all connections to the hosting website.
The evaluation questions your security review will ask.
If your organization requires IT security review before deploying new software, this addresses the most common evaluation criteria directly.
| Evaluation criterion | Answer |
|---|---|
| Data transmitted externally? | No. Zero data leaves the device during tool use. |
| Data stored externally? | No. All data is stored in user-selected local or network files. |
| Network connections during use? | None required. The tool operates completely offline. |
| Third-party JavaScript libraries? | No external libraries load at runtime. All code is contained within the single HTML file. |
| Cookies or browser storage used? | No cookies, localStorage, or sessionStorage. All session state exists only in browser memory during active use. |
| Telemetry or usage data collected? | None. No analytics, no error reporting, no usage data. |
| Software updates? | Delivered as new HTML file downloads. No automatic update mechanism runs in the background. |
| Installation required? | No. Runs as an HTML file in any modern browser. |
| FedRAMP authorization required? | No. Not a cloud service. Local execution only. |
| CUI handling? | No. Processes contractor-generated financial data only. |
| CMMC applicability? | Not applicable to this tool. CMMC governs systems handling CUI on DoD contracts — a separate matter from internal financial tools. |
| Penetration testing / vulnerability assessment? | Available on request for enterprise subscribers. The HTML file can be reviewed directly by your security team without external cooperation. |
What this architecture doesn't do — and we're telling you up front.
We believe in accurate security communication. These are genuine limitations of the current architecture that users should understand.
Browser security
No multi-user access control
No audit log of changes
Tier access enforcement
Future cloud version
Security questions from contractors and their advisors are expected.
We can accurately describe the tool's technical architecture and data handling. We cannot provide legal advice on how FedRAMP, CMMC, NIST 800-171, or CUI obligations apply to your organization's specific situation — for that, consult your legal counsel or a qualified government contracts compliance advisor.
Document version 1.0 · August 2026 · Subject to revision as the tool evolves