If it was a web app, you'd need to install it, probably with a database for settings, etc., which would invalidate their security claims.