The tracker was built for the environments CMMC actually targets — including closed networks where CUI lives and SaaS tools can't go. Everything about it works offline: the data layer (local storage only), the app itself (native desktop, or an installable PWA in the browser), and the licensing.
Offline by design
After activation, the desktop app never needs a network for day-to-day use. Your license is verified locally against a cryptographically signed certificate stored on the machine; when the app happens to be online it quietly refreshes that certificate, and when it isn't, nothing changes. Your assessment data is never transmitted anywhere in either case.
Air-gapped activation
A machine that can never go online activates by importing a machine file — a license certificate issued for that specific device's fingerprint and verified with the same signature checks as an online activation. The short version:
- On the air-gapped device, open the activation screen → "This device can't go online?" → copy the device fingerprint.
- On any connected machine, use the offline activation page — paste your license key and the fingerprint, and your browser downloads a signed
machine.licfile. No account or command line needed. - Move the file over (USB or whatever your environment allows) and import it from the same panel. The app verifies the signature, the fingerprint binding, and the validity window before trusting it.
A paid license's file is valid for 1 year; a trial key's file lasts through the trial. One offline device per license.
Renewing the license file
Before the "Works offline until" date shown in the License modal, repeat the download with the same key and fingerprint and import the fresh file. If the date slips past, nothing is lost — your assessment data stays put and the app simply gates until a fresh file is imported (or the device gets online once).
Things to know
- The device clock matters. A machine file that appears to be issued in the future (beyond a 24-hour tolerance) is rejected as clock-rollback protection — a badly wrong clock on the air-gapped device shows up as a stale-file error at import.
- Moving the seat off an air-gapped device can't be done in-app (deactivation needs the network) — email support@getcmmc.consulting and we'll free it.
- If the device later gets connectivity, everything behaves like a normal activation from then on — background refresh, updates, in-app deactivation.
Backups without a network
On an air-gapped machine, database export is your backup and your transfer mechanism: export the versioned JSON to removable media on whatever schedule your environment requires. Reports (SSP, POA&M, evidence) generate locally the same as anywhere else.