Stays on your machine
"Local" is a word software people use. Here is what it means in this product, plainly: your files do not go anywhere, the readable copies do not go anywhere, and the thing that reads them runs on the machine itself.
Not a badge — a description of where things are
Most tools that read your documents send them somewhere to be read. This one does not, and it will refuse to start a component that would.
Where your files are
on your diskYour files stay where they are. The software reads them in place. It does not copy them to a server. It does not copy them to us. It makes a readable copy beside each one, and that copy is also on your disk.
The list it keeps — the one saying what it read and what it could not — is a file on your disk. The index it builds so it can find things is a file on your disk: one file per set of records, an ordinary database file you can see in a folder, copy to a drive, or delete. Deleting it leaves the original files untouched, because they were never changed.
The founder's own records, run through this, sit in 21.7 gigabytes of such files on one computer.
What runs on the machine
all three of themThree things read your files, and all three run on the machine.
The first turns files into text. It runs on the machine.
The second reads scanned pages into text. It runs on the machine. On the founder's archive it read 35,633 pages, and not one of them went anywhere.
The third is the part that finds a line by meaning, not only by the exact word. This is the one people worry about, because in most products it is a call to somebody else's service. Here it is a small reading model that runs on the machine. Your text goes into it and comes out as numbers the index can search. The text does not leave.
The rule underneath it
If the software is configured with a reading component that would send your text to an outside service, it does not start. It does not warn and carry on. It stops, and says why. You would have to change the setting deliberately and start it again.
There is also no large language model inside the engine at all. The engine is 5,639 lines of code across 23 files, and the only model it loads is the small one that reads text into numbers. That is small enough that a person who reads code can read all of it.
What this does not mean
three honest limitsIt does not mean your machine is safe. That is still your machine, your backups, your passwords. This does not back up your files. If your disk fails, that is still your disk.
It does not mean nothing can ever leave. It means nothing has to, and the software refuses the one component that would. If you choose to put the readable copies on a shared drive, that is your choice and it happens outside this.
It does not mean it works without a machine. It needs one that is switched on. When the machine is off there are no answers. The files are still there. Nothing else is.
One corpus cannot see another
enforced, not configuredThis matters most to anyone with more than one company. Each set of records has its own file, and every read and every write has to name which set it is for. The software will not do either without that name — it raises an error instead. One company's records cannot see another's, and that is enforced in the part that stores the data, not by a setting somebody could forget.
Who can ask it questions is equally plain. Each person has a key. Each key can ask 120 times a minute and no more. Every request is written to a log that can be added to and never edited.
What is not hardened
This is a single-user, loopback design. It has not been through an external penetration test, and the security page says what else is outstanding. Running it and exposing it to a network are two different decisions, and only the first one is made for you.