Built to pass your IT review.
Written for the person who has to approve the install. Every claim on this page comes from the shipped code. Updated July 2026.
The short version
Paste this straight into the ticket:
Fulcrum VDC tools are small Windows desktop apps and Revit add-ins. They process project files locally — drawings, PDFs, and models never upload. Application traffic is HTTPS-only to a single host, hub.fulcrumvdc.com (sign-in, license check, and anonymous usage counts). The NWC Exporter Installer additionally downloads Autodesk's official exporter packages directly from Autodesk's own servers. Payment cards are handled end-to-end by Stripe. Downloads ship as ZIPs with SHA-256 checksums published at www.fulcrumvdc.com/security.html.
Network footprint
Firewall allowlist: hub.fulcrumvdc.com:443. That's the
only host our application code talks to — for the NWC Exporter
Installer, also allow Autodesk's download servers
(*.autodesk.com and *.autodesk.net —
some exporter packages, including Revit 2024's, are served from
damassets.autodesk.net), because it fetches the official
exporter installers straight from Autodesk rather than re-hosting them.
All connections are TLS.
| Endpoint | Purpose | When |
|---|---|---|
POST /api/auth/login | Sign-in | Once per sign-in; sessions persist |
POST /api/devices/register | Ties the install to your account | First run per machine |
GET /api/license/check | Confirms trial/plan state | Before a tool runs |
POST /api/usage | Reports usage counts (see below) | After a job completes |
POST /api/contact | In-app support requests | Only when you use Help → Contact |
GET /api/exporters/manifest | NWC Exporter Installer only — the current map of Autodesk exporter downloads (no sign-in) | At launch |
POST /api/grant-codes/redeemPOST /api/credits/notify-admins | Code redemption · low-credit alerts | Only on explicit user action |
What never leaves your machines
File processing is local — QR Splitter reads and writes PDFs with local libraries; the Revit add-ins run inside your Revit session. The complete usage payload our apps send is four fields:
{ "product": "qr-splitter", "qty": 8, "labels": 437, "idempotency_key": "…" }Counts, not content. No file names, no file paths, no document data, no model data — there is no endpoint that accepts file contents.
Connectivity model
- Online license check. Tools confirm license state with the Hub before running. If the Hub is unreachable, the tool tells you and declines to run — it fails closed rather than degrading silently.
- Offline-tolerant billing. Usage counts queue in a durable local outbox and sync when connectivity returns, de-duplicated by idempotency key — an outage never causes lost or doubled billing.
- No background chatter. These tools reach the Hub to sign in, to license a run, to fetch the exporter map (NWC Installer only), and when you use an account action — nothing else. No analytics or telemetry beacon phoning home. (Floating-license tools sold separately send a periodic keep-alive to hold your shared seat while open.)
Verify your download
Every download is delivered as a ZIP (or a plain .exe on request) through the Hub. Check the SHA-256 before you install:
Get-FileHash .\qr-splitter-2.2.0.zip -Algorithm SHA256| Product | Version | File | SHA-256 |
|---|---|---|---|
| QR Splitter signed | 2.2.0 | ZIP | 757b66c3030ee09a9b6458c916ade2191b9dbda60111e49bce739dc96653f127 |
| EXE | 3a5354a9f39d1a27b4cf03758e4ecaf0c74b11fcabd1cf9c5aa5658a8747471d | ||
| NWC Exporter Installer signed | 1.2.0 | ZIP | 1ad16b68d2c598cfc0dd15cddab9f2a2bf3b24c04fbadc4017225c3d523d5f54 |
| EXE | ef38083a2643b9789a142883dcb3d3126ca8b440688657991676499996117343 | ||
| Bulk Export signed | 1.3.0 | ZIP | e6f941cb0d8e2f7cf38270aba510d265f7f4a2897c542f0761e7afba4218b124 |
| EXE | d81cd7f93604994e2f1f1bccd4fc5bdb8e811475190a0cb395d2e0ce03b66780 | ||
| Room Tags 3D signed | 1.0.0 | ZIP | e5a23590fbdfc1256c6eb0ff0dbd3a320c139cc2d91899d9d887fd3a182f6e60 |
| EXE | 9592d7acc2e17047dcf1058713f989b35c9d734d17c3057b2621986b89a83a73 | ||
| Unistrut signed | 1.1.0 | ZIP | 055251af90b7562e650cc33ec6a38c313c3159568e4eadb853fd5f884f2722e7 |
| EXE | 5b58e92e6357cb034e05ba9f7c588834149f3371b3bdc20f681a5ff6b0be1a9c | ||
| Monostringer Stair signed | 0.3.0 | ZIP | 1574fc28c6c7026e19566f0bf5f3ed45fdadebc29c0051c5a5c29d4452edeb95 |
| EXE | 62f1208202896aa5e2f3aa684a6694fc36fc3c1cd548f9a5013ba1702ca88f26 | ||
| MEP Elevations signed | 1.6.0 | ZIP | 547252033838222bf9451ec5c05dba3553c3a9787f7ad85bd3c2426ea01b0b2d |
| EXE | ca1e5311d0ed048e381305e68624a25447f8a23f70ef6a9c0369ed7fafc9097e |
Code signing — where we are, honestly
Every executable we ship is Authenticode-signed as Fulcrum VDC, LLC, using an SSL.com OV certificate whose private key lives on a FIPS-validated hardware token — it cannot be copied off the device. That covers the installers you double-click and the add-in libraries inside them: 84 signed binaries across every current download. Each signature is RFC-3161 timestamped, so it stays verifiable after the certificate expires.
Check any build yourself: right-click the file → Properties → Digital Signatures. If the publisher is not Fulcrum VDC, LLC, do not run it.
One tool is a special case worth naming: the MEP Elevations extension for pyRevit is plain Python source, not compiled code — you can read every line it will run before you run it. Its installer is a signed executable like all the others; what it places into pyRevit stays readable source.
Signing removes the "Unknown Publisher" banner, but it does not remove SmartScreen entirely. Microsoft ended instant reputation for EV certificates in August 2024, so every new build — from every vendor — can still show "Windows protected your PC" until enough people have downloaded it. That prompt fades on its own. The checksums above remain your independent integrity check, which is why we publish them.
Platform security
- Transport: HTTPS everywhere with HSTS; the apps
talk only to
hub.fulcrumvdc.comover TLS (validated against the system trust store). - Credentials: passwords stored only as salted bcrypt hashes; sign-in endpoints are rate-limited; download forms are bot-checked (Cloudflare Turnstile).
- Payments: collected and stored by Stripe. Card numbers never touch our servers.
- Web hardening: an enforced Content-Security-Policy on this website (report-only rollout on the Hub), strict security headers on both, and CSRF protection on account actions.
- Infrastructure: backend on Fly.io (US), site on Cloudflare, transactional email via Postmark, error monitoring via Sentry. Full data practices in the Privacy Policy.
Questions or a security concern?
Send your security questionnaire or report an issue through the contact form — security reports go to the top of the queue.