MapleBOM

Privacy

What happens to your bill of materials.

A BOM is one of the most sensitive documents a manufacturer has. This page describes exactly what MapleBOM does with one, and it describes the implementation as it actually is — not as an aspiration.

Who operates MapleBOM

MapleBOM is an independent project built and run by Tyson Hamilton, a Canadian software engineer. There is no team behind it, no company you have not heard of, and nobody else with access to what you send. When you write to hello@maplebom.ca, that is who reads it and who replies.

Uploaded BOMs are not retained

When you upload a CSV, it is read into the web process's memory, parsed, analyzed, and rendered into the page returned to you. When that request ends, the data is released. Specifically:

  • The file is never written to disk. The upload size limit is set below the in-memory buffer size precisely so that the multipart reader never spills a temporary file.
  • The file contents are never written to the database. The database schema contains two tables — leads and analytics events — and neither has anywhere to put BOM data.
  • Your analysis is not saved. There is no report history, no share link and no account, because there is nowhere for a report to live. Reloading means uploading again.
  • The downloadable worklist and call list are built in memory alongside the page and embedded in it, so your browser saves a file it already had. No copy is kept here, and the download never contacts our server — we know only that a download happened, not what was in it.
  • Nothing is sent to a third party. The site loads no external scripts, fonts, images or trackers, and the analysis calls no external service.

What we do record

We record enough to know whether this product is worth building:

  • Page and funnel events — which pages were viewed, that an upload happened, and whether it succeeded. For an upload we store summary counts only: number of components, number of suppliers, whether origin and cost columns were present, and how long the analysis took. No part numbers, no descriptions, no supplier names, no prices.
  • A first-party session cookie holding a random value, so that a single visit's events can be counted as one visit. It identifies nobody and is not shared.
  • Details you type into the request form — your name, work email, company, role, approximate BOM size and what you are trying to solve. That is the whole point of the form, and it is stored.
  • Anything you send through the contact form — your name, email, optional company and your message, stored so that it can be answered. Contact messages are kept separately from analysis requests.
  • Standard web server request logs, including your browser's user agent and the page you came from.

None of it is sold, shared, or added to a mailing list. If you would like anything you have sent deleted, ask and it will be — one message to hello@maplebom.ca is enough, and you do not have to give a reason.

What we do not claim

MapleBOM is an early-stage experiment run by a small team. We are not going to describe security properties we have not built:

  • There is no certification, audit or formal compliance programme behind this site — no SOC 2, no ISO, and no third party has reviewed any of this.
  • There are no accounts, so there is no authentication protecting anything; there is simply nothing stored to protect.
  • The application runs on Railway, a third-party hosting platform, which serves traffic over HTTPS. The web process holds nothing between requests.
  • The database is managed by that same provider, so leads, contact messages and analytics events are held on their infrastructure.
  • We make no claim of Canadian data residency. MapleBOM is built in Canada, which is a statement about who writes it and who it is for — not about which country a server sits in. If residency matters to you, ask before sending anything and we will tell you where things actually run.

If your organisation's policy prohibits uploading a BOM to a third-party website, do not upload one. Run the sample analysis instead, and if the output is useful, get in touch — a sanitized BOM, with part numbers and prices scrambled, is enough to show you the same thing.

The analysis itself

One more commitment, because it is a privacy question in disguise: we do not enrich your BOM against outside sources, and we do not guess. If your file does not establish a country of origin, the report says Unknown / Unverified. We never infer origin from a supplier's location, a manufacturer's headquarters or a company's nationality.

Questions

Write to hello@maplebom.ca or use the contact form. If any of the above is unclear, or you think a sentence on this page overstates what the software actually does, that is worth telling us.

Uploads are limited to 25 MB. This page describes the current implementation and will be updated if the implementation changes.