Where screening runs, and what stays local.

Exactly one module may reach the network, the downloader of the public sanctions lists. The permission is a named allowlist with its reason: the files that may call out, each with the reason it may. A test reads the source of each module for network call sites (fetch, node:http and its relatives, WebSockets). It fails the suite (npm test) if any other module grows one. That test first proves it can see a call planted for it, so its zero means it looked and found none.

The downloader only pulls the list down and sends no data up. When it runs, no name you screen exists yet. The downloader moves public documents only.

npm run listes -- --fetch downloads ten public sources: OFAC SDN, the OFAC consolidated (non-SDN) lists, the US Consolidated Screening List (its Commerce and State lists), the UN Security Council list, the EU financial sanctions list, the UK Sanctions List, the EU's designated vessels, Australia's DFAT Consolidated List, the Consolidated Canadian Autonomous Sanctions List and New Zealand's Russia Sanctions Register. It writes a manifest, and the manifest is committed to git. The manifest holds the source, the URL, the date, the sha256 (the content hash of the file), the byte and entry counts. The list data itself stays out of the repository. When the tool later reads a list from disk, it recomputes the content hash. Screening against a list other than the recorded one certifies nothing. So the tool refuses a file that no longer matches the manifest and names both content hashes.

OFAC states its own record count inside the file, and on each fetch the tool checks the entries it read against that count. The UN address is the one the Security Council page publishes. Without the --fetch flag, npm run listes reports what is on disk and touches nothing.

The EU financial sanctions list carries asset freezes. It does not carry the vessels the EU bars from its ports and services: those are in Annex XLII of Regulation (EU) No 833/2014, which exists in no machine-readable file. So the tool reads the annex from the consolidated text of the regulation, served by the EU Publications Office, and the manifest records that file like the others, with its date and content hash.

The address names one consolidated version, dated 24 July 2026. A vessel designated by a later sanctions package is not in it until the tool is moved to the next version, so the manifest and every report state the date of the text that was read. The UK Sanctions List is a second source for vessels: it lists ships with their IMO numbers, and the tool keeps every number a ship carries.

CRUSETRA_OFFLINE=1, or its former name CASCADE_OFFLINE=1, cuts the network for the whole tool. Under it the suite passes and the measurement of your alert history runs. The one command that needs the network refuses, naming the flag and the way out. It prints no stack trace, the raw dump a crash leaves.

When you measure your own alert history, the outputs are written next to your file and nowhere else. They are a report and a public results file with its content hash. That file holds counts, rates, confidence intervals (the range a true rate likely sits in) and the answers keyed by your alert id. No screened name, no list entry you matched and no path with your username leaves the machine. Your identifiers do survive as those keys, so choose ones that carry no meaning. An account number used as an id stays in the outputs.

The screening itself runs on your machine against the lists on disk. There is no callback to us, no telemetry (usage data sent back) and no account. The only thing the evaluation needs from us is the repository, the code itself.