Define-XML metadata only
Datasets, variables, codelists, value-level metadata. It never needs the data itself — no SDTM datasets, no listings, no subject-level anything.
See what changes when your studies move to SDTMIG v4.0
A per-study reading of what v4.0 changes, from your Define-XML
Open the scanner, then select or drop in one or more Define-XML files.
Open the scannerFiles are processed locally in your browser and never uploaded. No account, no sign-up, no cost to see the result.
What it reads, and what it tells you
Study by study, across a portfolio
Add every Define you have. You get the count of affected studies, the specific datasets and variables behind each finding, and which study to start with.
Findings you can check, one by one
Every finding names the dataset or variable it was read from, says what v4.0 changes about it, and states how far Define-XML alone can settle it. Each one links to the rule it came from, so you can read the specification text behind it and disagree with it.
The file does not leave your browser
The browser is what holds that up, which is the kind of guarantee you can check rather than accept. The scanner page is served with a Content-Security-Policy whose connect-src is 'none', so the browser refuses the page any network connection at all: no analytics service, no font host, no error reporter, no CDN — and no path on this domain either. There is no destination your Define-XML could be sent to.
The code agrees with the header, for whatever that is worth on top. The scanner calls fetch nowhere, so scanning itself makes no network request, and the requests that load the page carry nothing of yours: they are the same files every visitor gets.
There is a mailing list, and it is deliberately not on that page. Once your result is up the scanner shows a link to a separate signup page; on that page, and only if you submit the form there, one request can happen — the email address, to a path on this domain, carrying the address and nothing else. The link carries no query string, so nothing about your scan follows you to it.
Your report is not emailed, because it is never ours to email. It is written in the tab that scanned the file and downloads straight out of it — HTML, Markdown or JSON, free, and behind no form.
You do not have to take our word for either half. Open devtools, read the response headers for the policy, and watch the network panel stay silent while you scan.
Every number traces to a published rule
The findings come from a versioned rules catalogue: what SDTMIG v4.0 changes, how it is detected in Define-XML, what it means for your study, and what to do about it. Each rule is marked confirmed against the published standard or flagged as draft, and each carries how conclusively a Define alone can detect it — because some changes cannot be settled from metadata, and saying so is more useful than a confident wrong answer.
The scanner shows the catalogue version and the standard it targets on every report it produces. The catalogue itself is published in full — read the rule before you believe the finding.
Find out in the next five minutes
Open the scanner and add one Define-XML. If nothing in your portfolio is affected, you have spent five minutes and learned something worth knowing.
Open the scanner