Working papers for independent consultants: no cloud

What SealedBrief is: a local-first desktop workspace

SealedBrief is built for professionals who are personally responsible for other people’s confidential information. SealedBrief’s Compute Plane runs with no network egress, so your documents and your questions stay on your machine.

SealedBrief indexes PDF, DOCX, TXT, Markdown, EPUB, and HTML files, and scanned images through on-device OCR. Beyond PDFs and Word files, SealedBrief indexes spreadsheets, slide decks, email files, and OpenDocument files, extracting their text on your own machine. Point SealedBrief at a folder and it keeps the index current on its own, re-indexing a file when you add or edit it. Answers are grounded in passages retrieved from your own documents and show the source paragraphs alongside the response.

Is the inference local, or is it an API call?

SealedBrief bundles the open Qwen3-8B and Qwen3-14B models under the Apache-2.0 licence as GGUF files.

SealedBrief splits documents at sentence boundaries and overlaps neighbouring chunks, so a point that runs across a break isn’t sliced apart before the model sees it. When a PDF page holds little or no selectable text, SealedBrief runs on-device OCR on it automatically, so scanned pages become searchable alongside born-digital ones. Retrieval blends meaning-based vector search with exact keyword search, so a specific case number, statute cite, or identifier is found even when a purely semantic match would miss it. SealedBrief can write a short summary under a document the first time you open it, generated on your own machine and only for the files you actually look at.

How would you falsify the offline claim?

Cut your machine off the network before you index a single file, then work as normal: indexing, search, OCR, and cited answers all keep running with no connection.

SealedBrief’s shipped AppImage bundles its models in the download, so the Compute engine’s opt-in first-run model-download hatch is never needed on a normal install and its network-egress guard stays active. The no-network rule is enforced at runtime for the whole life of the document engine, so even a future dependency that tried to phone home would hit a hard error instead of slipping through. You can trace SealedBrief’s document engine at the operating-system-call level and watch every connection attempt it makes resolve to loopback or a local IPC socket. During ingest and chat you can watch the document engine make no DNS query for an outside host: external name resolution is itself blocked, because a lookup is already traffic that leaves the device.

Why the update check is opt-in

The Presentation Plane makes two kinds of network call: a licence check and an opt-in update check. Neither the licence check nor the update check carries your documents or your queries.

Licence activation and heartbeat requests go to licenses.sealedbrief.com over a TLS-pinned connection and carry no document or query text. The licence requests are a small, fixed-shape JSON whose exact fields SealedBrief publishes, so their size and content do not vary with your document activity. Crash reporting is opt-in and off by default; when you turn it on it sends a scrubbed crash report that carries no document content. SealedBrief publishes which hosts its interface can contact, and invites you to report anything else your own packet capture shows as a bug.

Why the download is about 15 GB

CPU-only operation works but is meaningfully slower than running on a GPU or on Apple Silicon.

SealedBrief runs on an NVIDIA GPU, on Apple Silicon through Metal, or on CPU. In practice, SealedBrief matches its bundled language model to your hardware on its own — the larger Qwen3-14B on GPUs with more memory, the 8B model on smaller ones — with nothing to configure. The download is about 15 GB as a one-time download, because the models ship inside the application. Note that SealedBrief is not certified evidence-management software for any jurisdiction’s chain-of-custody rules.

How the licence is verified offline

A SealedBrief licence is a one-time purchase for a 3-year term, and it does not auto-renew. Every purchase is backed by a 30-day refund, separate from the free trial.

The licence is an Ed25519-signed file that is verified offline, so activation keeps working for the rest of your term even without the vendor. The Personal tier is a 3-year term licence priced at $199, with support in years two and three billed separately. The Personal tier is licensed for your own personal, non-commercial use; paid client work requires the Professional tier’s commercial-use grant. The Professional tier covers up to three devices, grants commercial use for paid client work, and adds an exportable evidence surface.

---

This article was drafted with AI assistance.