How PrivateDocs AI protects your security & privacy

Overview

Unlike a typical cloud service, PrivateDocs AI is a desktop application that does its work on your own hardware. Document parsing, OCR, chunking, embedding, vector search, and large language model inference all happen locally through a bundled Python sidecar and a local Ollama runtime. Because the sensitive work never travels the network, most of the usual cloud-security worries do not apply — there is no server-side document store to breach, no shared database to isolate tenants from, and no staff with remote access to your content.

The controls that matter here are different from a cloud product. They fall into a few layers:

• Local-first processing — nothing sensitive leaves the device
• Operating-system full-disk encryption for data at rest
• Strong account authentication (password + optional 2FA)
• Workspace scoping so retrieval cannot leak across projects
• Local, permanent deletion you control

Local-first by design

When you add a document, it is saved to a vault folder on your machine. Text is extracted, chunked, and embedded by the local sidecar using a local embedding model, and the resulting vectors are stored in a local ChromaDB database. When you ask a question, the retrieved chunks and your prompt are passed over a local IPC channel to the bundled Ollama runtime — not to the internet.

There is no cloud path for document or chat content, no “sync to cloud” feature, and no remote storage of your vault. The legacy cloud-GPU architecture that once existed in this codebase is inactive and is not part of the shipped product.

For the practical implications of running everything locally, including offline and air-gapped use, see System requirements & local mode.

What stays on your device

The following never leave your machine at any point:

• Original document files (PDF, Office, images, text, etc.)
• Extracted text and OCR output
• Chunked document fragments
• Embedding vectors and the ChromaDB index
• Your prompts and the model's responses
• Chat history and citations
• The local SQLite vault database

None of this is sent to us, to Supabase, to Stripe, or to any model API for processing. There is no telemetry from your documents or chat queries.

What touches the network

A small control plane does use the network, and only for things unrelated to your document content:

• Account sign-in and 2FA (Supabase Auth) — needed for first sign-in, trial start, and license activation.
• License verification — a one-time lifetime license flag; there is no recurring online check-in once activated.
• Billing (Stripe) — only when you purchase.
• Optional updates — the app can check for and download updates; this can be disabled.
• Initial model download — the first time a local model is pulled from the Ollama registry.

After sign-up and local license activation, the core vault and AI workloads continue to function with no network connection at all.

Authentication & 2FA

Your PrivateDocs AI account is protected by a password managed through Supabase Auth. Because the account controls app access and your license, we strongly recommend enabling two-factor authentication so that a leaked password alone cannot sign in.

2FA is genuinely implemented (time-based one-time codes plus backup codes), not just documented. After it is enabled, sign-in requires both your password and a rotating code from an authenticator app.

A vault is single-user: there is one account per install, and the account gates access to the app and your license. There is no multi-user membership or role system inside a vault.

For setup guidance, see the dedicated guides:

• Two-factor authentication
• Passwords

The local sidecar boundary

The bundled Python sidecar (which does parsing, embedding, and retrieval) binds only to the loopback interface — 127.0.0.1 on an OS-assigned port — so it is not reachable from other machines. Each time the app launches, a fresh per-session secret is written to a file with restrictive permissions and is required on every request to the sidecar. Requests lacking the correct secret are rejected, which prevents other local processes from driving the sidecar.

This means the sidecar is an in-process trust boundary on your own device, not an exposed network service.

Workspace isolation

Workspaces are the primary boundary between unrelated sets of documents within your vault. A workspace holds its own documents and chat conversations, and retrieval is scoped to the workspace you are currently working in — a question asked in one workspace cannot surface content from another, even though both live in the same local vault.

This makes workspaces useful for separating clients, matters, or sensitivity tiers without mixing their material. Documents can be moved or copied between workspaces, and deleting a workspace removes its grouping. Everything stays entirely on your machine.

Retention & deletion

You control how long content remains in your vault, and deletion is local and permanent. You can delete individual documents, entire conversations, or a whole workspace at any time.

• Soft delete moves a document to the Deleted Documents trash, where it can be restored.
• Hard delete (emptying the trash) purges the SQLite rows, the ChromaDB vectors, and the on-disk file. This is not reversible.

Because documents are not stored on any server, there is no server-side backup to retain a deleted item. If you need an external backup of critical files, keep your own copy outside the app — for example in an encrypted volume you control.

Verifying what the app does

PrivateDocs AI does not currently expose an in-app audit log of document or account activity; 2FA and your operating-system user account are the primary account-security controls. Because the app is local-first, however, you can verify its behavior independently:

• Use a network monitor (such as Little Snitch on macOS, GlassWire on Windows, or Wireshark) to confirm that document and chat traffic stays on loopback and that outbound connections are limited to auth, billing, and optional updates.
• Inspect the vault folder directly — the files, SQLite database, and ChromaDB index are all present on disk in plaintext, which is exactly why OS full-disk encryption matters.
• Run the app fully offline after activation to confirm the core vault and AI workloads need no network.

Need help? Visit the help center