IT review

What your IT department will ask

Written to be forwarded. Everything below is verifiable on the file itself.

If your organisation does not let you install software on your own judgement, that is a reasonable policy and we are not asking you to work around it. Send this page to whoever decides. It answers the questions that decision needs, in the order they are usually asked.

The short version

ShiftMask is a desktop application for Windows 10 and 11. It reads spreadsheet files the user points it at, writes a masked copy beside them, and keeps the mapping in an encrypted file on the same machine. It installs for a single user, needs no administrator rights, installs no service and no driver, and does its work with no network connection at all. There is no account, no telemetry and no cloud component.

What it installs, and where

The installer requires no elevation and will not prompt for it. That answers the technical question. If your policy is about running unapproved executables rather than about administrator rights, the rest of this page is the part that matters.

There is also a build that installs nothing

The portable version is a ZIP archive: unpack it, run the executable inside. No installer, no registry entry, nothing written outside the folder you unpacked it into, and it can live on a network share or a removable drive. It does not update itself, so the user comes back to the download page for each new release.

What leaves the machine

This is the section most reviewers turn to first, so here is the complete list rather than a reassuring summary.

While it is doing its work: nothing

Loading files, detecting relationships, masking, writing the copy and substituting results back all happen locally. This is not a policy statement — it is enforced by an automated test that replaces the socket layer and fails if the application opens any connection other than loopback during those operations. The test runs on every build.

Checking for a new version: one request, only when clicked

If the user clicks Check for updates, the application makes a single HTTPS GET for a static JSON file hosted on GitHub. No query parameters, no request body, no cookies, no device identifier, no licence number. The User-Agent header deliberately carries neither the version nor the machine ID, because the server has no reason to know who is asking. Nothing happens automatically and nothing is downloaded or installed without a further, explicit action by the user.

Activation: the application never contacts us

The user reads a device ID off the screen, pastes it into a page in their own browser, and pastes a licence token back into the application. The token is a signed file; the application verifies it offline against a public key compiled into the product. A licensed installation on a machine with no internet access works indefinitely.

Links: your own browser, as a separate process

Buttons that lead to our website, the terms, or an email message hand the address to the operating system, which opens the user's default browser or mail client. The application itself opens no connection.

One dependency that does reach the internet, once

ShiftMask renders its interface with the Microsoft Edge WebView2 Runtime. Most managed Windows estates already have it. Where it is missing, the package carries Microsoft's own bootstrapper, which downloads the runtime from Microsoft — and it runs only after the user is shown what is missing and explicitly agrees. If that is not acceptable, the runtime can be installed in advance from Microsoft's offline installer; the procedure is on our air-gapped deployment page.

No telemetry. No analytics inside the application. No crash reporting. No account, no sign-in, no licence check phoning home. Nothing about the user's files — not a file name, not a column name, not a value — is transmitted anywhere by the application, because the application does not transmit.

Code signing, and how to verify it yourself

Both the installer and the portable build are signed as 4optima Sp. z o.o., through Microsoft's Azure Trusted Signing service, with a timestamp — so the signature stays valid after the signing certificate expires.

Windows SmartScreen may still show a warning on a recent release. That is a reputation counter, not a verdict on the signature — a newly published file has not yet been installed by many people. The signature is the thing worth checking, and it is checkable with the two commands above.

Third-party components

The application ships a complete THIRD-PARTY-NOTICES.txt inside its own folder, listing every runtime dependency with its licence text — currently 28 packages, plus CPython and two typefaces. The build is wired to fail if any dependency arrives without a licence text, so that file cannot silently fall out of date.

The Python runtime is bundled inside the executable. No system-wide Python, no separate runtime and no additional framework has to be installed on the workstation.

Data protection

4optima never receives the user's data, because the product has no channel through which to send it. That makes us a supplier of software rather than a processor of your data, and it means adopting ShiftMask does not add a sub-processor to your records.

One point worth stating plainly, because it decides whether this tool fits your policy at all: ShiftMask produces a pseudonymised copy, not an anonymous one. The mapping between real and substitute values is kept, encrypted, on the user's machine — that is what allows results to be mapped back afterwards. Under the GDPR the masked copy remains personal data, handled under your existing obligations; what changes is that the copy you hand to an external tool no longer identifies anyone.

And one limit worth knowing before you approve it: ShiftMask protects identities, not the shape of your business. It deliberately keeps what makes the copy useful — the ratios between amounts, the intervals between dates, the relationships between tables, and the column names. Someone reading the masked copy cannot tell which customer, which product, or what anyone actually paid. Rescaling amounts is not encryption, though: every amount in a column is multiplied by the same hidden factor, so anyone who already knows one real amount in that column can work out the rest of it. They can see roughly how many customers the business has and when its busy season falls. Most confidentiality obligations are about who and on what terms, and that is the line the product holds. If yours also covers the structure of the business itself, then no masked copy sent outside is enough, and the answer is a model running on your own infrastructure.

The vault holding that mapping is encrypted with Fernet, with the key derived from the user's passphrase through PBKDF2 at 600,000 iterations. The passphrase is never stored and cannot be recovered by us.

Who publishes it

ShiftMask is a product of 4optima Sp. z o.o., a company registered in Poland — the same legal entity named in the code signature. Registration numbers and the registered address are on the legal page. The organisation's identity was verified by Microsoft as part of issuing the signing certificate.

More than a few seats

Licences are per device today, and the installer is a per-user installer. If you are looking at a managed rollout, a shared licence pool or a deployment package for your software distribution system, write to us rather than working around it — those are on the roadmap and we would rather build them against a real requirement than a guess.

Something not answered here

Write to shiftmask@4optima.pl and say which question is open. A security review that ends in “no” because we failed to answer something is a worse outcome for us than a “no” on the merits.

Everything on this page describes ShiftMask 0.2.5 and later. Where a statement is checkable on the file itself — the signature, the notices file, the install locations — check it rather than taking our word for it.