Local AI for lawyers: question privileged files without them leaving your machine

You are the custodian of every privileged file — a cloud chatbot isn’t

You hold the client and matter files. When a privileged document is exposed, the person who answers for it is you — to the client, to opposing counsel, to yourself — not a vendor’s status page and not a chatbot’s terms of service. That is why pasting a matter file into a general-purpose cloud AI is a decision you would have to defend afterward: the moment the text leaves your disk, confidential material has entered a system you did not build and cannot inspect, and there is no taking it back.

SealedBrief takes the other path. It is a desktop AI workspace that runs the model on your own machine and reads your own documents there. You point it at a matter folder and it answers questions about those files locally — the documents never leave your machine. This page is about the mechanism, not a promise: what runs where, what is and isn’t encrypted, and how you can verify the no-egress claim yourself rather than take it on faith. If a confidential file can’t leave your machine, the AI that reads it shouldn’t either — SealedBrief runs the model locally, so the file stays where it is.

Why a cloud chatbot is a disclosure problem for privileged files

When you send a matter file to a hosted AI, three things happen that are hard to account for later.

• The file travels to a third party outside your control. It leaves your office over the network and lands on infrastructure you don’t own — the vendor, their subprocessors, their hosting providers, and anyone with access to that chain. For privileged material, the transmission itself is the step you would have to account for later — not just an incident afterward.
• Retention, logging, and training are things you can’t inspect. “We don’t train on your data” toggles and retention windows are commitments about data the vendor already holds. You can’t audit them from outside, and the terms can change.
• There is no after-the-fact proof of where the file went. If you ever had to show what happened to a specific document — who could technically read it, whether it was copied — a cloud chatbot leaves you with the vendor’s word, not your own record.

A large firm papers these over with a procurement team and a data-processing agreement. A solo or boutique practice outside managed-cloud IT has no one to absorb that liability but you. Keeping privileged files off third-party servers is the simplest way to keep the record inside the boundary you are actually accountable for.

How SealedBrief works with your matter files, locally

Point SealedBrief at a matter folder and its ingestion engine indexes the files in place. There is no upload and no proprietary cloud store — the documents stay where they already sit on your disk. It reads PDF, DOCX, TXT, Markdown, EPUB, and HTML, and extracts text from scanned pleadings and still images (PNG, JPG, TIFF) with on-device OCR. It works in English, Portuguese, or French. It does not transcribe audio or video.

You then ask questions in natural language over your own files. Every answer is grounded in retrieved passages from your documents and shows the source paragraphs alongside the response, so you can check each claim against the exact text it came from. When the model cannot ground a claim in your corpus, it says so rather than inventing a citation.

Treat every answer as a junior associate’s draft — read the cited passages before you rely on it. The value is in surfacing and locating what your own files already contain, not in an authority you should take unverified. This is the same wedge SealedBrief makes across regulated work; see the broader case for private, local AI for confidential documents.

A defensible record you actually own

Because the workspace runs on your hardware, the trail of what happened stays with you. SealedBrief keeps an on-device log of what it indexed — a record you hold, rather than a log handed to a vendor and requested back later. If you ever need to show your own account of how a document was handled, it is a file on your disk, not a support ticket to a company that may or may not still exist.

That is the distinction that matters for matter files. If you ever need your own account of what was ingested and when, that record lives with you — a file on your disk, not something behind a vendor’s help desk. The Professional tier adds an exportable evidence surface built for exactly this: an at-rest encryption proof, a network-egress attestation, and the ingestion audit log. It is framed as your own account of how a document was handled — a file you export and keep, not a log you request back later.

What’s encrypted, and what honestly isn’t

SealedBrief encrypts your indexed content on disk. The document text, source references, and metadata are encrypted field by field with AES-256-GCM, using HKDF-SHA256-derived subkeys and a fresh random nonce per record; the core database and the full-text search index sit behind SQLCipher AES-256 page encryption. The master key lives in your operating system’s keychain. Every document is encrypted at rest before it touches disk.

One carve-out belongs up front, not buried, because precise claims are the point: the embedding vectors — the numeric representations used to find relevant passages — are stored unencrypted. Approximate-nearest-neighbour similarity search needs to do plaintext math over those numbers, so they cannot be encrypted at rest without breaking the retrieval that makes the product work. Text and metadata are encrypted; the vectors are not. It is not accurate to say everything on disk is encrypted, and SealedBrief does not claim that.

Verify the no-egress claim yourself

SealedBrief runs as two operating-system processes that cannot swap roles. The Compute Plane — the part that touches your documents, runs the model, and searches your index — has no network egress by construction. The Presentation Plane, the interface, contacts sealedbrief.com only to validate your licence and check for updates. Neither process contains your documents or your questions.

That is what makes the claim checkable. Run a packet capture on your own machine while you query your files and watch the traffic: the document-handling process opens no connection, and the interface’s calls carry a licence check and an update check, never your records. A technician — or your firm’s IT contact — can reproduce it in a few minutes. Follow the full verify-it-yourself walkthrough for the exact commands.

Note the precise boundary, so you can hold SealedBrief to it. It is not that the application makes no network calls ever. It is that the process handling your documents makes none, and the process that does talk to the network never has your content to send. SealedBrief says your documents never leave the machine — not that the program never speaks to the internet.

Scope and honest limits

A lawyer personally answerable for these files deserves the boundaries stated plainly, not just the pitch.

• The model is a local open one. SealedBrief ships with Qwen3-8B and Qwen3-14B (both Apache-2.0, GGUF, auto-selected by your available VRAM). These are capable open models running fully offline; they are not frontier hosted models, and you should not expect GPT-4-class reasoning. Verify the citations against the cited passages every time.
• Hardware shapes the experience. On a Linux workstation with a 12 GB-or-larger NVIDIA GPU, answers come back in seconds. It also runs on 8–12 GB GPUs, on Apple Silicon Macs (M1–M4) via Metal, and CPU-only — the last of which answers in tens of seconds. Plan on roughly 16 GB of RAM and about 15 GB of free disk.
• Download and formats. The full package is a single ~15 GB one-time download that bundles the models, with nothing fetched at runtime; after that it runs fully offline. It reads PDF, DOCX, TXT, Markdown, EPUB, HTML, and scanned images via on-device OCR — no audio or video transcription.
• Windows is a waitlist, not a release. It is genuinely blocked on an encryption-library dependency, not a marketing “coming soon.” If you work on Windows, join the waitlist — you are not charged until it ships, and this page won’t imply otherwise. Linux and macOS on Apple Silicon are what run today.
• This is a technical control, not a compliance certification. Keeping privileged files on the device is a meaningful safeguard, but it does not by itself satisfy any rule, and nothing on this page is legal advice about your confidentiality obligations. How a given control maps to your duties is a question for your own judgment.

Personal versus Professional — what it costs

Both tiers run the same on-device workspace; the differences are additive, and Personal is never crippled.

• Personal — $199 for a 3-year term, plus $49/year support in years 2 and 3 ($297 total over the term), for one device. The right fit for a solo practitioner working in personal capacity.
• Professional — $499 for a 3-year term, plus $109.99/year support in years 2 and 3 ($718.98 total over the term), for up to three devices. It adds a commercial-use grant that covers paid client work, and the exportable evidence surface — an at-rest encryption proof, a network-egress attestation, and the ingestion audit log — that gives you a defensible, self-owned account of what was indexed and that nothing was transmitted.

The licence is an Ed25519-signed file verified offline, so activation works even if the company were to disappear — it keeps working for the rest of your term. If a term lapses, the vault opens read-only; nothing is deleted. Both tiers are a 3-year term licence — not perpetual, not a subscription — backed by a 30-day, no-questions refund that is separate from the free 14-day trial. You can compare both tiers on the pricing page.

Try it on your own matter files

The download is the full 14-day trial, not a limited demo. On first launch you choose “Start 14-day trial” on the welcome screen — no account, no credit card, and starting the trial makes no network call. Index your real matter files, ask real questions, and read the cited answers on your own hardware.

After 14 days the app opens read-only. Nothing is deleted and nothing is locked away — you keep full read, search, and export (Markdown and PDF) of everything already indexed. Only indexing new documents and asking new questions pause until you enter a licence, which unlocks the same install instantly with no reinstall and no lost work.

The most useful next step is to run it against files you actually can’t upload, and capture the traffic while you do. Download the free 14-day trial — Linux and macOS on Apple Silicon, ~15 GB download — or compare both tiers on the pricing page if you already know which one fits your practice.