How to use AI on confidential documents without uploading them

Why pasting a confidential file into a cloud AI chatbot is the wrong move

The reflex is understandable. You have a dense contract, a diagnostic letter, an unreleased manuscript, a board pack — and a chat box that offers to summarise it in seconds. So you paste it in. The problem is not the summary you get back. It is what the paste itself does to the file.

When you upload a document to a hosted AI assistant, a copy of that file leaves your computer and comes to rest on servers you do not control. From that moment, its handling is governed by someone else’s terms, retention schedule, and access rules — not yours. Even when a provider states that inputs are not used to train its models, you are trusting a claim about infrastructure you cannot inspect, made by a company that can revise the policy later, be breached, or be compelled to hand over what it holds. For a file you are personally answerable for, that is a copy you can no longer account for.

The instinct to reach for AI is not the mistake. The mistake is the upload — and it is avoidable, because the upload is not actually required to get a useful answer out of a document. It is just the design most tools happen to use. The alternative is to run the AI where the document already lives: on your own machine, so there is no copy to send and nothing to opt out of.

This guide walks through what that looks like in practice — what “local” has to mean before it counts, how the workflow actually feels, and, most importantly, how to prove to yourself that nothing left.

What “runs locally on your machine” actually means

“Private” and “local” are overused words. Plenty of tools that use them still send your files to a cloud; they just encrypt the connection on the way there. That protects the bytes in transit and does nothing about the copy that arrives at the other end. So the phrase worth pinning down is not “private” — it is no network egress: the part of the software that reads your documents opens no outbound connections at all.

SealedBrief is built that way on purpose, using a split-brain design of two separate operating-system processes that cannot swap roles:

• The Compute Plane is the part that touches your files. It runs the model, the retrieval, the embeddings, the on-device OCR, and the encrypted local storage. It has no network access by construction — it does not open outbound connections, so there is no path for a document or a question to travel out.
• The Presentation Plane is the window you click in. It reaches sealedbrief.com for two narrow things: checking your licence and checking for updates. Neither request carries your documents or your queries.

That distinction is worth stating honestly, because the sloppy version of the claim is false. It is not that the application makes no network calls ever — it checks a licence and looks for updates like normal software. It is that the process holding your documents makes none, and the process that does reach the network has nothing of yours to send. That is what lets you run AI on documents locally without the usual trade, and it is the same architecture behind SealedBrief’s broader approach to private, local AI for confidential documents.

How it works: point it at a folder, ask questions, read cited answers

The workflow is deliberately ordinary. There is no upload step because there is nowhere to upload to.

1. Point it at a folder. SealedBrief indexes your documents in place — PDF, DOCX, TXT, Markdown, EPUB, HTML, and scanned pages or photographs through on-device OCR. Your files stay where they are; nothing is copied into a cloud store or a proprietary vault elsewhere.
2. Ask questions in plain language. You query the whole set at once — “where does this figure first appear,” “which of these agreements mention the same counterparty” — and it retrieves the relevant passages from your own corpus and answers from them. This is retrieval-augmented generation running entirely on your hardware.
3. Read the cited answer. Each response shows the source passages it drew from, so you can click straight to the exact page a claim came from. When the model cannot ground a statement in your documents, it says so rather than inventing a citation to fill the gap.

At no point in that loop does a file or a question leave your computer. The one thing to keep in front of you is what is producing the answer, which is the subject of the honest-limits section below: it is a local open model, so the citations are there to be checked, not trusted blindly.

How to verify nothing leaves your machine — a five-minute check

You should not take any of the above on faith, least of all from the vendor selling you the software. The no-egress claim is built to be tested, and the test is short.

Start a packet capture on your own machine — tcpdump, Wireshark, or whatever your IT team uses — then open SealedBrief, index a folder, and run a full question-and-answer session while it records. Watch what the Compute Plane sends while it works on your files: nothing goes out. The network activity you do see comes only from the Presentation Plane’s licence and update checks, and you can open those packets to confirm they carry no document content and no query text. This is how you use AI without sending your data to the cloud and then check the claim, rather than believing it.

The check takes about five minutes, it is repeatable on demand, and it produces the same result on your security team’s machine as on yours. For the exact commands — the packet capture, the per-process socket inspection, and an at-rest encryption test you can run on the stored files — follow the verify-it-yourself walkthrough. That is the difference between “we don’t send your data anywhere” as a marketing line and as something you are invited to falsify.

What is encrypted at rest, and what honestly isn’t

Keeping documents on your machine is one question; how they sit on your disk is another, and it deserves a precise answer rather than a reassuring one.

At rest, SealedBrief encrypts the sensitive parts of its own store. The extracted document text, source references, and metadata are protected with field-level AES-256-GCM. The core database and the full-text search index sit behind SQLCipher’s AES-256 page encryption. The keys live in your operating system’s keychain.

There is one carve-out, and glossing over it would be dishonest: the embedding vectors — the numeric representations used to find relevant passages — are stored unencrypted. Nearest-neighbour search has to do plaintext math over those numbers, so encrypting them at rest would break the retrieval that makes the product work. The text and metadata are encrypted; the vectors are not. Vectors are lossy and hard to turn back into readable prose, but they are not sealed, so do not treat them as if they were. Encryption at rest protects files on a locked or powered-down machine; it is not the control that helps if someone is sitting at your unlocked disk. It is one honest layer, described for what it is.

The honest limits, up front

A tool you are trusting with confidential work should tell you what it cannot do, before you rely on it.

• The model is local, not frontier-scale. SealedBrief bundles Qwen3 — an 8B or 14B open model in GGUF format, auto-selected to fit your hardware — and runs it on your own machine. It is not a large hosted frontier model, and it will not match one on every task. Its output is a cited draft you verify, which is exactly why the sources are shown. Read them before you rely on anything.
• It needs real hardware. It runs well on a 12 GB-or-larger NVIDIA GPU, runs on Apple Silicon Macs via Metal, and will run CPU-only, just more slowly. Plan on roughly 16 GB of RAM.
• It is about a 15 GB download. The models ship inside the application, so it is a large one-time download; after that it works offline, fetching nothing at runtime.
• No audio or video transcription. It reads documents and images — including scanned and photographed pages via on-device OCR — but it does not transcribe recordings.
• Platforms. Linux (a portable AppImage that runs on any distribution) and macOS (a signed, notarized build for Apple Silicon) ship today. Windows is a waitlist — it is genuinely blocked on an encryption-library dependency, and you are not charged until it ships.

How to try it on your own files

The most direct way to judge private AI for sensitive documents is to run it against your own files, on your own hardware, while you watch the network yourself.

The download is the full 14-day trial, not a limited demo. On first launch you choose “Start 14-day trial” on the welcome screen — no account, no credit card, and starting the trial makes no network call, which you can confirm with the same packet capture described above. For 14 days you get the complete workspace over your own documents: index, ask, read cited answers, search, and export.

After 14 days the app opens read-only. Nothing is deleted and nothing is locked away — you keep full read, search, and export (Markdown and PDF) of everything already indexed. Only indexing new documents and asking new questions pause until you enter a licence, which unlocks the same install without a reinstall.

When you are ready, download the free 14-day trial. If it earns a place in your workflow, it is a 3-year term licence — not a subscription and not perpetual — at $199 for Personal or $499 for Professional, and every purchase is backed by a 30-day refund that is separate from the trial. You can compare the two tiers on the pricing page.