Architecture & Security

How the Add-ins Work

SimpleAddins are Microsoft Word task pane add-ins built with Office.js — Microsoft's official framework for extending Office applications. They run inside Word's task pane sidebar and interact directly with your document through the Word JavaScript API.

Key Characteristics

• Client-side only: All processing happens on your local machine. No document content is ever sent to a server.
• Offline capable: Once installed, the add-ins work without an internet connection. Only licence checks and feedback submission require connectivity.
• Sandboxed: Add-ins run in a secure sandbox with limited privileges — they can only access your document through the Office.js API, never the file system directly.

---

Technology Stack

Component	Technology	Purpose
Language	TypeScript 5.x	Type-safe JavaScript with modern features
Framework	Office.js	Microsoft Word API integration
Build	Webpack 5	Module bundling with product-specific overlays
UI	Vanilla HTML/CSS	Lightweight, no external UI framework dependencies
Storage	Office.js Settings API	Persistent user preferences and data
Auth	MSAL.js	Microsoft SSO integration
Payment	Stripe.js	Client-side licence purchasing
Documentation	VitePress	Static site generator for this documentation

---

Security Model

Local-First Data Architecture

The most important security principle is that your document data never leaves your machine:

Operation	Where it happens	Data transmitted
Scanning fields	Local Word API	None
Filling fields	Local Word API	None
Applying changes	Local Word API	None
Colour coding	Local Word API	None
Saving clips	Local Office settings	None
Saving sessions	Local Office settings	None
Licence check	SimpleAddins API	Licence key only
Sending feedback	SimpleAddins API	Your message only

Data Storage

User data is stored using the Office.js Settings API, which provides two storage types:

• Roaming settings: Synced across devices via your Microsoft/Office 365 account
• Document settings: Saved within the specific Word file

All sensitive data (SSO tokens, user profile, clips) is encrypted with AES-256 before storage using the internal SecureStorage module.

---

Privacy by Design

What Data is Collected

Minimal telemetry only:

• Licence validation requests (licence key hash, timestamp)
• Feedback messages (only when explicitly submitted by you)
• Anonymous error reports (if you opt in)

What Data is NEVER Collected

• Document content or structure
• Field values you enter
• Text from clips you save
• File names or paths
• User behaviour analytics
• Third-party tracking data

Ejudiciary Users

For users signing in with @ejudiciary.net Microsoft accounts:

• Email domain is checked locally to enable Pro-equivalent features
• No special tracking or data collection occurs
• Enhanced Export and LLM Import features are unlocked client-side after SSO verification

---

Zero-Pin Design

The add-ins use a zero-pin architecture for clean resource management:

• No persistent timers: No setInterval loops running in the background
• No document event listeners: No DocumentSelectionChanged handlers pinning the JavaScript runtime
• Explicit cleanup: Event listeners are removed when panels close or tabs switch

This means:

• Documents can close cleanly without "save pending" warnings caused by the add-in
• Word can shut down normally even if the add-in is open
• No background CPU usage when the add-in is idle

---

Third-Party Dependencies

Dependency	Purpose	Privacy Impact
Microsoft Office.js	Word API	Microsoft standard library
MSAL.js	Microsoft SSO	Authenticates directly with Microsoft
Stripe.js	Payment processing	Loads from Stripe; card data never touches our servers

No analytics libraries, tracking pixels, or advertising scripts are included.

---

Next Steps

• Data Privacy Policy — detailed breakdown of what data is stored where
• Signing In — authentication and account security
• Troubleshooting — resolving common issues