--- title: "The specifics for your security review · OfficeBrief" description: "Documents, optional AI, data sovereignty, smart-card data, read-only defaults and compliance." url: "https://royalsoftworks.com/products/office-brief/security/specifics/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security · 2 of 2 # The specifics for your security review. Documents, optional AI, data sovereignty, smart-card data, read-only defaults and compliance. What's actually in place ## The specifics for your security review. ### No document ever leaves the machine Content search, OCR, conversion, archiving and template printing all run as local processes. The program goes online only to download what you ask for — OCR language data the first time a language is used, and the AI scanner's engine and model if you turn it on — and it never sends a document, a scan or card data out. ### AI only if you choose it, and only locally Content search is plain case-insensitive substring matching. OCR is Tesseract — a deterministic, open-source recognition engine, not a language model. An optional AI scanner, off by default, runs a vision model on your own machine for scans Tesseract struggles with. There are no embeddings, no classification and no cloud model. ### Data sovereignty by default Documents, scans and templates stay on the machine and the drives you point it at. Nothing is mirrored, cached, or uploaded anywhere as part of normal operation. ### Smart-card data stays local and minimal When a PC/SC reader is attached, OfficeBrief reads the card through a small platform-native component and uses the result only to fill the template you're working on. No reader, no card data — the feature is inert and nothing else in the app is affected. ### Read-only by default Browsing, previewing and searching never modify a file. Anything that changes data — rename, convert, delete — is an explicit, separate action. ### Compliance fits the architecture, not a policy document Because your documents never leave your infrastructure, where they live and who can reach them is settled by how the product is built, not by a promise layered on top. That is the part of a HIPAA or GDPR review the software can answer; the rest is your organisation's programme. ## Read the full technical reference. Architecture, the OCR pipeline, the template engine, and the exact smart-card data boundary — written for IT and procurement review. [Read the whitepaper](https://royalsoftworks.com/products/office-brief/whitepaper/) [FAQ](https://royalsoftworks.com/products/office-brief/faq/) Written up, not shipped. There is nothing to download yet. · [Get notified →](https://royalsoftworks.com/contact/?product=office-brief&tier=notify) [Previous No cloud. No uploads. No surprises.](https://royalsoftworks.com/products/office-brief/security/no-cloud/) [All of OfficeBrief security](https://royalsoftworks.com/products/office-brief/security/)