Security
Security and privacy
Frame Bench is a desktop application that works on packet captures on your own computer. This page lists what it sends, what it stores and what it trusts, so a security review does not need a questionnaire.
Your captures stay on your machine
- Captures, decoded frames, key log files, notes and edits are processed locally. They are never uploaded.
- No telemetry, analytics or advertising, and nothing is reported automatically. There is an optional local crash log, off by default, that stays on your computer. No account or login.
- The application does not capture from a network. The desktop app can send frames you built onto an interface, only if you turn that on and confirm each send (see the table). Otherwise it reads and writes the files you choose.
- Captures often hold credentials and personal data. Frame Bench does not redact them, and anything you export is written only where you choose.
Stored on your computer
- Settings and window position, and the list of recent captures (file names and folder paths, never contents).
- Your license and its activation record, protected by your operating system.
- Autosave of your work and the local crash log, only if you turn them on. Both are off by default.
- All of it lives in the application's user data folder (for example %APPDATA%\Frame Bench on Windows) as ordinary files, so your disk encryption protects it. Uninstalling and deleting that folder removes everything.
Network activity: the complete list
| What | When | What is sent | To |
|---|---|---|---|
| License activation | Once per installation (standard licenses) | The license ID and a random installation ID | www.framebench.ca |
| License release | Only when you choose Remove license (standard licenses) | The license ID and the same random installation ID, so the seat can be used on another computer | www.framebench.ca |
| License check | Each time the app starts (standard licenses) | A random one-time value, nothing else | www.framebench.ca |
| Links you click | Only when you click: Help, About, release notes, homepages | Nothing from the app. Your default browser opens the address. | framebench.ca, netomize.ca |
| Send frames to a network | Only after you turn it on and confirm | The frames you chose. Nothing goes to us. | The interface you pick |
- An offline license makes no connections at all, for air-gapped and restricted networks. Netomize issues these at its discretion: contact us to ask.
- No automatic update check. Updates are installers you download and run yourself.
- Behind a firewall, allow HTTPS to www.framebench.ca. Nothing else is needed.
- Netomize keeps an activation record (license ID, installation ID, first and latest activation, a count). Our server keeps that record protected. Our web host keeps ordinary connection logs. Details are in the privacy statement.
How the application contains risk
- The application window runs sandboxed, with no direct access to your system.
- It reads only the files you pick, and links open in your default browser.
- Sending frames is off until you turn it on, and each send asks you to confirm.
What is inside
- Electron (Chromium and Node.js), two small libraries (brotli-decode and fzstd) that decompress captured web traffic, and, in the desktop app, koffi (MIT), used only to call Npcap, which you install separately.
- No other runtime dependencies. No scripts, fonts or images are loaded from the internet.
- A software bill of materials (CycloneDX) and the license notices ship with the installer, under About, Third-party licenses and are published here: SBOM (.json), license notices (.txt).
- Decryption features (TLS, DTLS, QUIC) read the key log you give them, locally, and write decrypted output only to files you choose.
Questions and reports
Security questions and vulnerability reports: support@framebench.ca with "Security" in the subject. We reply by email.
Applies to Frame Bench 1.0. Last updated October 2026.
All Rights Reserved © Netomize