Local AI for journalists: research your files without exposing sources

The duty: if a document can identify a source, it cannot touch a third party’s server

You told a source their name would stay with you. That promise is only as strong as the weakest place their documents come to rest. A leaked memo, a spreadsheet with an internal author field, a scanned page whose metadata names the office it came from — any of these can burn the person who handed them to you, and the exposure often happens far from your notebook: on a vendor’s servers, in a backup you didn’t authorize, in a log an engineer can read.

Most AI research tools ask you to upload the very files you are trying to protect. The moment a sensitive PDF leaves your laptop for a cloud model, a copy exists somewhere you do not control, held by a company that can be subpoenaed, breached, or simply asked. Source protection, in practice, is not a moral posture. It is a question of where the bytes physically are.

SealedBrief is local AI for journalists built on one decision: the documents stay on your machine. You point it at a folder of notes, transcripts, and leaked files; it indexes them in place and lets you question the whole set — and it does that work on your own hardware, with no upload step to opt out of because there is no upload at all.

Why cloud AI tools are a breach-and-subpoena surface for reporters

When you send a document to a hosted model, you inherit every risk of the host. A private AI for source protection has to eliminate the intermediary, not just encrypt the pipe to it.

• A subpoena has somewhere to land. If a vendor holds your files, that vendor can be compelled to produce them, sometimes without notifying you. Remove the vendor from the loop and there is no third-party custodian to serve.
• A breach has something to take. Uploaded corpora accumulate. A single misconfiguration or intrusion can expose thousands of reporters’ materials at once. Files that never leave your disk are not in that pool.
• Retention is not yours to set. “Deleted” in a cloud console rarely means deleted on disk, in backups, and in training pipelines. On-device, the retention policy is your filesystem.

This is not a legal shield — nothing here protects you from a device seizure or a court order directed at you, and this page is not legal advice. What it removes is the extra copy: the one sitting on infrastructure you have never seen, governed by a policy you did not write.

How SealedBrief questions a document set locally, with citations to the exact passage

SealedBrief is a local-first AI workspace that runs offline AI for investigative journalism over your own material. You give it a watch directory — a folder of PDFs, DOCX and TXT files, EPUBs, HTML, Markdown — and it indexes everything in place. There is no proprietary store and no migration; your files stay where they are.

Then you ask questions across the whole set: Which of these contractors appears in both the 2023 filings and the leaked email thread? Where does this figure first show up? Every answer is grounded in retrieved passages from your own documents and shows the source paragraphs alongside it, so you can click back to the exact page a claim came from. When the model cannot ground a statement in your corpus, it says so rather than inventing a citation.

Treat the output the way you would treat a stringer’s first draft: read the cited passages before you rely on anything. The answers come from a local open model (Qwen3), not a frontier hosted system, so verification is the workflow, not an afterthought. That makes it a genuinely usable AI notes tool that protects sources — a way to analyze leaked or sensitive documents without uploading them — precisely because the trade you are refusing (upload for convenience) is one it never asks you to make.

Under the hood, two separate operating-system processes do the work, and they cannot swap roles. The Compute Plane — the process that reads your documents, runs the model, and stores the index — has no network access by construction. The Presentation Plane — the interface — reaches sealedbrief.com for two narrow things only: validating your licence and checking for updates. Neither call carries your documents or your queries. This split-brain design is the same one behind SealedBrief’s broader approach to private, local AI for confidential documents.

Encryption at rest for your notes and files — and what it does and does not cover

On disk, SealedBrief encrypts your material at rest. The core index (the file registry, system metadata, and full-text search) is protected with SQLCipher AES-256 page encryption. The document text, source references, and metadata are encrypted field by field with AES-256-GCM, using HKDF-SHA256-derived subkeys and a fresh random nonce per record. The master key lives in your operating system’s keychain.

One nuance matters, and reporters deserve it stated plainly rather than buried: the embedding vectors — the numeric representations used for similarity search — are stored unencrypted, because the nearest-neighbour math needs plaintext to run. Your document text and metadata are encrypted; the vectors are not. Vectors are lossy and hard to invert back into readable text, but they are not encrypted, so do not treat them as if the underlying prose were sealed. If someone has your unlocked disk, encryption at rest is not the control protecting you; the no-egress design is a separate matter from what an attacker with physical access can do.

Encryption at rest protects files sitting on a powered-down or locked machine. It is not a claim about a running, unlocked vault, and it is not immunity from anyone who compels you directly. It is one layer, described for what it is.

Verify the no-egress claim yourself — a five-minute packet capture

You should not take a privacy claim on faith, least of all from a vendor. So the central claim here is built to be checked.

Run a packet capture on your own machine — tcpdump, Wireshark, or your newsroom’s tooling — and then index a folder and ask a few questions. Watch the traffic. The Compute Plane, the process handling your documents, opens no network connections during the query. You will see just two connections from SealedBrief: the interface’s licence check and its update check against sealedbrief.com — and you can inspect those packets to confirm they carry no document contents and no queries. An editor or your newsroom’s IT can reproduce this in about five minutes, and it is repeatable on demand. Follow the full verify-it-yourself walkthrough for the exact commands.

That is the difference between evidence and a promise. On-device AI for reporters is only worth anything if you can prove the “on-device” part — so the design invites the capture rather than asking you to trust a policy page.

Honest limits

A tool you are personally liable for deserves the caveats up front, not in a footnote.

• Local model quality. The bundled model is Qwen3 (an 8B or 14B open model, auto-selected by your GPU), running fully local. It is capable, but it is not a frontier hosted system. Expect to verify citations; expect the occasional miss on long or messy corpora.
• OCR yes, transcription no. On-device OCR reads scanned leaks and photographed pages — PDFs, and PNG/JPG/TIFF images — extracting text without the image touching a server. There is no audio or video transcription; a leaked recording is out of scope, and you would need to transcribe it elsewhere first.
• Hardware. The recommended setup is a Linux workstation with a 12 GB+ NVIDIA GPU; it also runs on 8–12 GB GPUs and on Apple-Silicon Macs (M1–M4) via Metal, and will run CPU-only but slowly. Plan on 16 GB of RAM and about 15 GB of free disk for the roughly 15 GB download.
• Platforms. Linux (a portable AppImage that runs on any distribution) and macOS (a signed, notarized build for Apple Silicon) ship today. Windows is a waitlist — it is blocked on an encryption-library dependency, and you will not be charged until it ships. If you are on Windows, you can join the waitlist rather than buy today. Journalism skews toward Mac and Linux, which is why those platforms are supported first.
• Not a legal shield. Again: this removes the third-party copy and encrypts files at rest. It does not defeat a subpoena directed at you or a seizure of your device. It narrows the attack surface; it does not erase it.

How to try it on your own material

The honest way to evaluate a source-protection tool is against your own files, on your own hardware, watching your own network. So the download is the free 14-day trial — the full workspace, not a limited demo. On first launch you choose “Start 14-day trial” on the welcome screen: no account, no credit card, no signup — and the trial start makes no network call, which you can confirm with the same packet capture. Run that capture during the trial and confirm the behaviour before you decide anything.

After 14 days the app opens read-only. Nothing is deleted and nothing is locked away — you keep full read, search, and export (Markdown and PDF) of everything you have already indexed. Only indexing new documents and asking new questions pause until you enter a licence. There is no reinstall and no lost work.

When you are ready, start the free 14-day trial. If it earns a place in your workflow, compare the two licences on the pricing page: Personal is $199 for a 3-year term (one device), Professional is $499 for a 3-year term (up to three devices, plus a commercial-use grant and exportable audit evidence — an at-rest encryption proof, a network-egress attestation, and an ingestion audit log). It is a 3-year term licence — not a subscription, not perpetual — and every purchase is backed by a 30-day, no-questions refund that is separate from the free trial.