Processing happens on the device. This is not a promise: it is a verified property.

The engine that analyses text has no technical ability to open a network connection, and an automated check verifies this on every release.

What stays on the device, and what does not.

Every security control is built to fail closed. If name recognition is missing or does not respond, the text does not leave.

The document archive and the mappings are encrypted with AES-256-GCM. The key lives in the operating system keychain.

Every update and every dictionary carries a signature the application verifies before use. Downgrades are refused.

The application can recognise signatures, not produce them.

Automatic detection works alongside user review: the final decision stays with whoever knows the document.
Analysis works on text: PDFs made only of images need conversion first.
Anonymisation is irreversible by design: nobody can reconstruct the data, ourselves included.
The encryption key stays on the device: documents cannot be opened elsewhere, not even by us.