AirtallySecurity and architecture
Data flow
- The app is a static web page. It reads only public FCC data: the station's facility record and the folder and file listings of its online public inspection file (file names and upload dates). Documents are not downloaded.
- Folder listings: a direct browser request to publicfiles.fcc.gov (the FCC's manager API allows browser requests). If your network blocks it, the same request goes through our Worker.
- Station search and facility record: through our Worker, a read-only pass-through limited to four FCC request shapes, because the FCC's service API does not allow browser requests. It keeps no record of the answers. If the FCC's search service does not answer, the app searches its own copy of the FCC facility list (/data/stations.json, built from the same API).
- The check runs in the tab. Results and downloads are never sent to our server. Licensing uses three small endpoints: checkout configuration, license issue (Paddle transaction ID and checkout email) and a health check, plus an anonymous visit counter (an event name such as "sample opened" and the link's campaign tags; daily totals only, no IP address, call sign or result stored).
How to verify it yourself
- Open the browser's developer tools (Network tab) during a check: you see requests to publicfiles.fcc.gov and /api/fcc/ only, and none that carries a result.
- Read the code: the engine is plain, unminified JavaScript under /core/ (opif.js applies the rules, fcc.js reads the FCC data, outputs.js builds the files) and /assets/app.js.
Engine checksums (release 1.0.0, 30 October 2026)
SHA-256 of the files that read and process the data, as published on this site. Compare with certutil -hashfile file SHA256 or shasum -a 256.
- /core/opif.js: 823a02ba7e02998ea1113d28ded24b5d8aff2efed2639b6bff129995f25b0dc1
- /core/fcc.js: d533b059783b0d17bd17f8b0a5bea4d8e863853c8fa52fee4d70f00b28ae1c96
- /core/outputs.js: be3f4a9eebc38809fd88f2658928eb3709c33f4f8a0c7f9f57796cc87bd0917b
- /core/xlsx-write.js: af9ca2f2085e8136ea6c02460b9dbb91b3e3082dd1eff6d2f92d5b4a90827da9
- /assets/app.js: e49a550a5ed77240b8decf73e1be2a2f877be4e0dda84908711bc671573f3374
Rule check
Every time the app opens it reproduces 21 FCC examples and records: the FCC's own count of late issues/programs lists in Notice of Apparent Liability DA 23-1051 (KWDK(TV), Tacoma, from the station's public file listing as the FCC API returned it on 30 October 2026), the deadline examples written into 73.3526(e)(12), seven license expirations in the FCC's own records against the 73.1020 table, the 2027 renewal and petition dates, the 1 August EEO report date the five States with December renewals share, and the 73.3580 announcement rule (21/21 today).
| Check | FCC | Airtally | |
|---|---|---|---|
| DA 23-1051 KWDK: lists more than one year late | 7 | 7 | ✓ |
| DA 23-1051 KWDK: lists one month to one year late | 4 | 4 | ✓ |
| DA 23-1051 KWDK: lists one day to one month late | 1 | 1 | ✓ |
| DA 23-1051 KWDK: quarters late in all | 12 | 12 | ✓ |
| 73.3526(e)(12): October-December list due | January 10 | January 10 | ✓ |
| 73.3526(e)(12): January-March list due | April 10 | April 10 | ✓ |
| FCC shutdown extension: July-September 2025 lists due | 2025-12-01 | 2025-12-01 | ✓ |
| FCC Public Notice DA 19-26: October-December 2018 lists due | 2019-02-11 | 2019-02-11 | ✓ |
| 73.1020: WTOP-FM (FM, DC) license expiration in the FCC record | 2027-10-01 | 2027-10-01 | ✓ |
| 73.1020: WAYU (FM, AL) license expiration in the FCC record | 2028-04-01 | 2028-04-01 | ✓ |
| 73.1020: WQXE (FM, KY) license expiration in the FCC record | 2028-08-01 | 2028-08-01 | ✓ |
| 73.1020: KBUT (FM, CO) license expiration in the FCC record | 2029-04-01 | 2029-04-01 | ✓ |
| 73.1020: KPTJ (FM, TX) license expiration in the FCC record | 2029-08-01 | 2029-08-01 | ✓ |
| 73.1020: KXZM (FM, CA) license expiration in the FCC record | 2029-12-01 | 2029-12-01 | ✓ |
| 73.1020: KWDK (TV, WA) license expiration in the FCC record | 2031-02-01 | 2031-02-01 | ✓ |
| 73.3539: renewal due for radio licenses expiring 1 Oct 2027 | 2027-06-01 | 2027-06-01 | ✓ |
| 73.3584(f): petitions to deny for licenses expiring 1 Oct 2027 | 2027-09-01 | 2027-09-01 | ✓ |
| 73.2080(c)(6): EEO report anniversary, California radio | 08-01 | 08-01 | ✓ |
| 73.2080(c)(6): EEO report anniversary, Illinois TV | 08-01 | 08-01 | ✓ |
| 73.2080(c)(6): EEO report anniversary, North Carolina radio | 08-01 | 08-01 | ✓ |
| 73.3580(b)(1)(ii): 6 announcements, 4 weeks, at most 2 a week | true | true | ✓ |
Browser hardening
- Content-Security-Policy: scripts only from this site and, when you buy, from cdn.paddle.com; connections only to this site, publicfiles.fcc.gov and Paddle; framing blocked.
- Every file name read from the FCC is shown as text, never as HTML. No analytics, advertising or tracking cookies. Your license key is kept in local storage and verified offline with an Ed25519 signature.
Sub-processors
- Cloudflare: hosting of the static site, the license endpoints and the FCC pass-through.
- Paddle.com: merchant of record for payments, invoices, tax and refunds.
Contact
support@atesensoftware.com: questionnaires, vendor forms and quotes, answered within one business day.