· The AI Web Factory team
Perito Tacho: the forensic software where case data never leaves the computer
We built it with zero network requests, because a driver's ID number and evidence under chain of custody pass through it. What we learned applies to any website that handles other people's data.
There is a kind of requirement that almost never shows up in a software brief: that the program must not connect to the internet. Not once. Not even to check for updates.
We imposed it on ourselves in Perito Tacho, the tool Pedro Mulero uses to work on his expert witness cases. It is for internal use: it is not for sale and never will be. And it turned out that almost everything it forced us to think about applies to an ordinary business website. That is what this post is about: what you learn when you cannot afford to let a single piece of data leave the computer.
What goes through it
A tachograph expert report does not handle “user data”. It handles the name and the DNI (the Spanish national ID number) of a specific driver, the exact time the lorry started every day for the last two months, where it crossed a border and sometimes the driver’s medical report. The file downloaded from a driver card is also evidence: it is submitted in court proceedings with a chain of custody behind it.
That binary leaving the computer is not a configuration detail. It is an incident.
Put that way, the question stops being “how many requests do we make?” and becomes “why do we make any at all?”. Which is a much better question, for a website too.
What “offline” means when you mean it
The easy part is writing “the application runs locally” in a brochure. What we actually had to remove:
No CDN. Not for a charting library, not for an icon. A tag pointing to someone else’s domain is a request from the user’s computer to a third party, carrying their IP address and the time. Everything was downloaded once, reviewed and stored in the repository.
No remote fonts. Google’s fonts are the most common case and the
most invisible one: every visit to a page with a font loaded from
fonts.googleapis.com is a connection from that person’s browser to
Google, before the page has even finished drawing.
No telemetry. Not anonymous, not “to improve the product”.
No automatic updates. This one costs more than it seems, because it means updating a dependency is a decision someone makes, checks and signs off. It is more work. It is also the only way to know what code is actually running.
The side effect is curious: since it cannot pull in anything external, the program is lighter and starts faster. Privacy and performance tend to go hand in hand, even though they are sold as different things.
The two exceptions, in writing
Saying “zero connections” and then making one is the quickest way for the rule to stop meaning anything. So there are exactly two exceptions, each written down with its scope, its authorisation date and its limit. Whatever is not there does not go out.
The first: the timestamp. When a document is issued, its digital fingerprint (a SHA-256, sixty-four characters) travels to a timestamping authority that sends back a signed timestamp. The fingerprint goes out. The document does not, nor the case file, nor the client’s name, nor a single piece of case data. A fingerprint cannot be reversed: nothing can be rebuilt from those sixty-four characters.
The second: the sealed capture of a web page. It is used to record that a sales listing said what it said before the seller edits it. And here comes the awkward part, which is exactly what needs writing down: in this one the full address does go out, because the timestamping authority has to visit the page. If that address carries an identifier in the query string, that leaves the computer.
That is why the second exception can only be launched by hand, from its own command, one address at a time. It is not automatic, it is not chained to the issuing of any document, it warns on screen before sending anything and asks for confirmation. An address with a username or password inside it is rejected without asking.
The lesson, which is the part worth keeping: an exception that is not written down is not an exception. It is an open door nobody remembers leaving that way.
What a timestamp proves. And what it does not
It pays to be precise, because people exaggerate a lot here.
Article 41.1 of Regulation (EU) 910/2014, the one known as eIDAS, prevents an electronic timestamp from being denied admissibility as evidence just because it is not qualified. But Article 41.2 reserves the presumption that the date is accurate and the data intact for qualified timestamps, which are those issued by a supervised provider.
In plain words: a timestamp from a free authority is admissible and proves that a document with that exact fingerprint existed on that date and has not changed since. It does not carry the legal presumption of a qualified timestamp. In court it is usually enough. Saying it is “notarially certified” would be a lie.
We prefer the long true sentence to the short salesy one. Here too.
Reproducible or worthless
The other rule is that the same input file must produce the same result, byte for byte, on different runs and on different computers. That rules out two things inside the calculation engine: the system date and random numbers.
It sounds like a programmer’s obsession until you picture the scene: the opposing expert takes the same file, processes it with the same tool and gets something different. A report that cannot be reproduced cannot be defended. So timestamps are injected from outside. They are never read from inside.
There is a web equivalent of this, less dramatic but real: if your website is built differently every time, nobody can know what was published last Tuesday.
What this has to do with your website
More than it seems, because the underlying question is the same: do you know what data about your visitors leaves your website for third parties?
An ordinary small business page usually sends, without anyone having consciously decided it:
- Every visitor’s IP to Google, because of the fonts.
- The IP, the page visited and the time to an analytics tool, often before the visitor has touched the cookie banner.
- The same data to Facebook, if someone pasted a pixel three years ago for a campaign that no longer exists.
- All of the above again to YouTube if there is an embedded video. Also to Google Maps if there is a map.
A contact map and an introductory video can add up to more third-party connections than the whole rest of the site put together.
Article 5.1.c of the GDPR requires personal data to be “adequate, relevant and limited to what is necessary”. It is hard to argue that sending someone’s IP to three different companies before they have even read your phone number fits that. And Article 5.2 adds the part people forget: the controller not only has to comply but has to be able to demonstrate it.
Almost nobody can, because almost nobody knows what their own website loads.
How we do it in what we deliver
No heroics and without giving up anything visible:
Fonts are served from your own domain. They are downloaded once and uploaded with the site. That is the end of the connection to Google. The visitor sees exactly the same typeface. Since it travels with the rest of the page, it usually loads faster.
No third parties before consent. Analytics, the map and the video do not load until the person accepts. If they do not accept, the map is replaced by an address and a link, which works just as well for getting to your workshop.
Every external script has to justify itself. If nobody remembers why it was added, it goes. It is surprising how many websites drag along pixels from campaigns that ended years ago.
What the privacy policy says is what really happens. A legal document listing providers you no longer use is worse than not having one: it proves nobody has looked at it. We wrote about this in another post.
None of this turns a website into a fortress. It turns it into a website you can explain, which is what you will be asked for the day someone asks.
Why we are telling you this
Because it is how we work. Better that you see it before hiring us than after.
Tarraco App Lab was born out of a forensic expert practice, not a marketing agency. That explains these habits better than any statement of principles: once you have had to defend a piece of data in front of a judge, you lose any wish to put things on a website that you cannot explain.
If you want to see the rest of what we do, it is all gathered in the link container. And if your field is transport, Perito Camión is the forensic side. Carretera Nacional publishes employment information for the sector without selling anything and Oriana Mail is the email client we use every day, built with the same rules this post describes.
And if you have a website and do not know what it is sending out there, that is a reasonable question to ask us.
Comments
To comment you need to sign in with an account. We never publish your email.
When you sign in, your name and profile picture are saved with your comment. You can delete it whenever you like. We explain it in theprivacy policy.
