Local AI for researchers under NDA: query proprietary R&D on your own machine

The clause you signed doesn’t make an exception for “I only pasted a paragraph”

If you work under a non-disclosure agreement or hold proprietary R&D, the confidentiality duty is personal. It names you, not an abstract organization. The obligation usually reads something like shall not disclose Confidential Information to any third party — and a cloud AI service is a third party. Uploading a sponsor’s dataset, an unpublished manuscript, or a lab notebook to answer a question is a disclosure, whether or not anything visibly goes wrong afterward. Many research and licensing agreements go further and forbid transmitting the material to any system where a vendor could retain, index, or train on it.

That is the specific bind: the work most worth asking an AI about — the unfiled patent draft, the partner’s formulation data, the interview transcripts under embargo — is exactly the work you are contractually barred from handing to a hosted model. So the useful tool sits behind a rule you can’t break.

SealedBrief resolves this by moving the model to the documents instead of the documents to the model. The AI runs entirely on your own machine. Your corpus is indexed in place and questioned locally, so there is no upload event to disclose and no third-party processor to account for. This page explains how that works, what is and isn’t protected, and how you can verify the no-egress claim yourself rather than take it on faith.

Why “sync to the cloud and trust us” fails an NDA or a data-processing review

A hosted AI assistant, however well run, changes the answer to one question your counterparty or ethics board will ask: who else can technically access this data? The moment a document leaves your disk, the honest answer includes the vendor, their subprocessors, their infrastructure providers, and anyone with lawful or unlawful access to that chain. For ordinary work that trade is often acceptable. For proprietary R&D and NDA-bound material, it frequently is not — and the reviewer’s job is to assume the trade rather than the promise.

Retention policies and “we don’t train on your data” toggles do not fully close this, because they are commitments to not do something with data the vendor already holds. A private AI for NDA documents has to remove the holding, not just the intent. The defensible position for confidential work is that no personal or proprietary data was transmitted at all — so there is no processor in the loop to contract with, audit, or breach.

SealedBrief is built around that position. It is an on-device AI for R&D and proprietary research: the part of the application that reads your files never opens a network connection. There is nothing to sync, and no server-side copy of your corpus to reason about in a review. The same tradeoff decides confidential work in adjacent fields — see the broader case for running local AI over confidential documents, or the parallel problem of keeping clinical session notes on-device.

Cited RAG across your papers, datasets, and lab notes

Point SealedBrief at a folder — a directory of papers, protocols, datasets, meeting notes, or manuscript drafts — and its ingestion engine indexes everything in place. There is no proprietary store and no re-upload; the files stay where they are. It reads PDF, DOCX, TXT, Markdown, EPUB, and HTML, and extracts text from scanned pages and still images (PNG, JPG, TIFF) with on-device OCR. It works in English, Portuguese, or French. It does not transcribe audio or video.

You then ask questions in natural language. This is self-hosted RAG for a research corpus: every answer is grounded in retrieved passages from your own documents and shows the source paragraphs alongside the response, so you can check the claim against the exact text it came from. When the model can’t ground a claim in your corpus, it says so rather than inventing a citation. That makes it usable for an AI literature review without cloud upload, and for the narrower, higher-stakes work of interrogating a single confidential dataset offline.

Treat the output the way you would treat a junior associate’s draft: read the cited passages before you rely on the answer. The value is in surfacing and locating what your own corpus already contains — not in an authority you should take unverified.

What is protected at rest, precisely

SealedBrief encrypts your indexed content on disk. Text, source excerpts, and metadata are encrypted with field-level AES-256-GCM (HKDF-SHA256 subkeys, a random 12-byte nonce per record), and the core database — the file registry and the full-text search index — sits under SQLCipher AES-256 page encryption. The master key is held in your operating system keychain.

One carve-out matters, and a technical reader should have it stated plainly rather than discover it later: the embedding vectors are stored unencrypted. Approximate-nearest-neighbour similarity search needs to do plaintext math over those vectors, so they cannot be encrypted at rest without breaking retrieval. Text and metadata are encrypted; the vectors are not. That is the honest boundary of the at-rest guarantee.

On key handling, the tested claim is deliberately narrow. The raw key bytes SealedBrief manages are zeroed once per-record keys are derived, and after you lock the vault a memory-dump scan finds no copy of them. While the vault is unlocked, working copies necessarily exist in the keychain and database engine — so the guarantee is “no lingering copy after lock,” not a claim that the key is never in memory.

Verify the no-egress claim yourself — there is nothing to take on trust

SealedBrief runs as two operating-system processes that can’t swap roles. The Compute Plane — LLM inference, retrieval, the search index, OCR, and ingestion — is the part that touches your documents, and it has no network egress by construction. Only the Presentation Plane — the interface — reaches the network, and it does so for exactly two things: licence validation and update checks. Neither of those ever carries your documents or your queries.

You do not have to believe that from a marketing page. Run a packet capture on your own machine during a real query session and watch which process talks to the network and which does not. Your IT contact can reproduce it in a few minutes. This is the difference that matters for proprietary work: because nothing is transmitted, there is no processor to enter a data-processing agreement with — the reviewer’s question about third-party access has a structural answer, not a policy answer. Follow the full verify-it-yourself walkthrough for the exact commands.

Note the precise claim, so you can hold us to it: the document-handling process makes no network calls. The application as a whole does check your licence and look for updates. We say your documents never leave the machine — not that the program never speaks to the internet.

Honest limits

• The model is a local one. SealedBrief ships with Qwen3-8B and Qwen3-14B (both Apache-2.0, GGUF, auto-selected by your available VRAM). These are capable open models running fully offline; they are not frontier hosted models, and you should not expect GPT-4-class reasoning. You can swap in any GGUF model that fits your hardware.
• Hardware shapes the experience. It runs best on a Linux workstation with a 12 GB-or-larger NVIDIA GPU, where answers come back in seconds. It also runs on 8–12 GB GPUs, on Apple Silicon Macs (M1–M4) via Metal, and CPU-only — the last of which answers in tens of seconds rather than seconds. Plan on roughly 16 GB of RAM and about 15 GB of free disk.
• Download size. The full package is a single ~15 GB download, with nothing fetched at runtime.
• Formats. PDF, DOCX, TXT, Markdown, EPUB, HTML, and scanned images with on-device OCR; no audio or video transcription.
• Platforms. Linux (a portable AppImage that runs on Debian, Ubuntu, Fedora, Arch, or NixOS with no install step) and macOS (a signed, notarized .dmg for Apple Silicon; Intel Macs are not supported) ship today. Windows is a waitlist — it is genuinely blocked on an encryption-library dependency, and there is no charge until it ships. If you are on Windows, join the waitlist.

Personal versus Professional

Both tiers run the same on-device workspace; the differences are additive, and Personal is never crippled.

• Personal — $199 for a 3-year term, plus $49/year support in years 2 and 3 ($297 total over the term), for one device. This is the right fit for individual, unfunded, or personal-capacity research.
• Professional — $499 for a 3-year term, plus $109.99/year support in years 2 and 3 ($718.98 total over the term), for up to three devices. It adds a commercial-use grant that covers paid client and contract work, and a compliance-and-audit evidence surface: an exportable at-rest encryption proof, a network-egress attestation, and an ingestion audit log. For funded, sponsored, or contract R&D, that exportable egress attestation plus the ingestion record gives you a defensible, self-owned account of what was indexed and that nothing was transmitted — a record you hold, not one held by a vendor.

The audit and egress-attestation surface is a Professional feature; it is not part of Personal. Both are a 3-year term licence — not a perpetual licence and not a subscription — and both are backed by a 30-day, no-questions refund, separate from the free trial. Compare the two on the pricing page.

Try it on your own corpus

The download is the free 14-day trial — the full workspace over your own documents, not a limited demo. On first launch you choose “Start 14-day trial” on the welcome screen: no account, no credit card, and starting the trial makes no network call. Index your real files, ask real questions, and read the cited answers on your own hardware.

After 14 days, the app opens read-only. Nothing is deleted and nothing is locked away — you keep full read, search, and export (Markdown and PDF) of everything already indexed. Only indexing new documents and asking new questions pause until you enter a licence, at which point the same install unlocks instantly with no reinstall and no lost work.

The most useful next step is to run it against a corpus you actually can’t upload, and capture the traffic while you do. Download the free 14-day trial for Linux or macOS (Apple Silicon), or compare the two licences if you already know which tier fits your work.