ActuarialOS for Excel

Security & Data-Handling Statement

For IT departments and security reviewers evaluating the add-in for deployment: what it is, what it touches, what it sends, and how to verify it.

Last updated: 2026-09-06 (beta) — every row below re-read against the code that day; the
Source: Published verbatim from the add-in’s own SECURITY.md

For IT departments and security reviewers evaluating the add-in for deployment. One page: what it is, what it touches, what it sends (nothing — its one network call is a content-free version check), and how to verify it. Last updated: 2026-09-06 (beta) — every row below re-read against the code that day; the census and its findings are in PUBLIC-REVIEW.md.

What it is

A single-file Excel add-in (.xll, Excel-DNA / .NET Framework 4.8, 64-bit) that adds actuarial worksheet functions (=aos_…) and formula-builder dialogs to Excel. All reference data (published SOA mortality tables, IRS/PBGC/SSA/Treasury series) is compiled into the file — there is no runtime download, database, or companion service. No installer is required to evaluate it (File ▸ Options ▸ Add-ins ▸ Browse); the commercial release ships a signed installer.

What it accesses

Surface	Access	Detail
Network	One optional call: the update check.	On each Excel start the add-in makes at most one network call: a read-only HTTPS `GET` of a small static version file (`version.json`, ~50 bytes) to see whether a newer version has been published. Nothing is transmitted — no token, no machine identifier, no custom headers, no query string, and never anything from a workbook (census data, participant data, results never leave the machine). The request has a ~2-second timeout, is never retried within a session, and every failure is silently ignored — if it succeeds and a newer version exists, the only effect is a one-line "newer version available" note inside the Help and License dialogs. There is no auto-update and no download: updating is always a deliberate reinstall through your normal channel. To block it: deny the update host (`www.actuarialos.io`) at your firewall/proxy/DNS — the add-in behaves identically in every functional respect (all calculations are local; the note simply never appears). If a build ships with the update URL unset (a `.invalid` placeholder), it skips the call entirely and makes zero network calls. A future license check will POST only `{token, tool, version}` (metadata, never workbook content) over HTTPS, and the add-in runs even if that check is unreachable (fail-open by design).
File system	None beyond its own load.	The add-in reads and writes no files. The installer copies the `.xll` to `%LOCALAPPDATA%\ActuarialOS\Excel` and the sample workbooks to `Documents\ActuarialOS`; the sample workbook is opened only if the user accepts the one-time first-run offer (or opens it themselves).
Registry	HKCU only.	One key, `HKCU\Software\ActuarialOS\Excel`: `LicenseToken` — the user's beta key / account email, written from the License dialog or the installer's optional beta-key page; `FirstRunSample` — a one-shot path written by the installer and deleted by the add-in after the first-run sample offer. The installer also writes the standard per-user Office `OPEN` value (`HKCU\Software\Microsoft\Office\<ver>\Excel\Options`) that tells Excel to load the add-in; uninstall removes it. No machine-wide (HKLM) writes; no admin rights.
Processes / shell	One, and only when you click it.	The ribbon's Send feedback button hands a `mailto:` link to Windows, which opens your default mail client with a message pre-addressed to hello@actuarialos.io and the build version filled in. Nothing is sent until you press Send, and the body asks you not to include plan or client data. That is the only process launch in the add-in: otherwise no child processes, no shell execution, no macros, no VBA.
Excel object model	Standard add-in use.	Reading the active cell (formula builders / edit-in-place), writing a formula the user inserts, ribbon + dialogs. Nothing is captured or persisted.

Data confidentiality

All calculations run locally, in-process. The add-in contains no telemetry, no analytics, and no crash reporting. Its only outbound traffic is the content-free update check described above (a GET of a static file — the request carries no data and can be blocked with no functional effect). This is deliberate: actuarial census data is confidential, and the product's design rule is that plan data never transits the network — including in the future licensing path, which is metadata-only and fail-open (a licensing outage can never block or alter a valuation).

Integrity & authenticity

Code signing: commercial builds are Authenticode-signed (.xll and installer), with timestamped signatures. Verify: file Properties ▸ Digital Signatures, or Get-AuthenticodeSignature aosFunctions.xll in PowerShell. A file whose signature is missing or broken did not come from us unmodified — do not load it. (Beta builds may be unsigned; distribute them only through the channel you received them from, and verify the file hash we publish alongside each beta drop.)
Reproducibility: every computed number is cross-checked against the ActuarialOS reference engine before release — tens of thousands of golden checks at ~1e-15 relative error, run against the exact obfuscated bits that ship (the count of record lives in PROJECT.md, not here; a number in this sentence went stale once already) — and =aos_Version() / =aos_Versions() stamp the engine + data version in-cell for audit trails.

Deployment notes

Requires 64-bit Excel on Windows (2016+; dynamic-array features light up on Microsoft 365). .NET Framework 4.8 (in-box on Windows 10/11). No admin rights needed for per-user use.
Trust Center: the add-in respects Excel's add-in trust settings; for managed deployments, sign-based trust policies ("require application add-ins to be signed by trusted publisher") work once the publisher certificate is deployed.
Uninstall (installer builds): Settings ▸ Apps ▸ ActuarialOS for Excel removes the .xll, its Office OPEN registration, the sample workbooks and the one-shot FirstRunSample value. It deliberately keeps LicenseToken so a re-install recognises you — clear the license from the ribbon first, or delete that value under HKCU\Software\ActuarialOS\Excel, and nothing is left behind. A manually Browse-loaded .xll: remove it from File ▸ Options ▸ Add-ins and delete the file.

Reporting

Security questions or suspected issues: contact the maintainer through your beta channel. Please include the add-in version (=aos_Version()).

← ActuarialOS for Excel · Questions: hello@actuarialos.io