Security & privacy, verifiably.

This page is written for the sceptic in the room — the compliance officer, the managing partner, the IT consultant. It states what the software does today, lists every way any byte can leave your Mac, and shows how to check each claim without trusting us.

Last updated August 2026. Present tense = shipped behaviour. Future tense = planned, and labelled so.

The complete egress inventory

Parchwell has no accounts, no server dependency, no telemetry, no analytics, no automatic reporting of any kind and no update phone-home. Two rows cover everything:

What	When	What is transmitted
Optional model download	Only when you ask for a larger AI model	A request to huggingface.co for a model file pinned to an exact version and verified against its SHA-256 fingerprint before use. Nothing about you or your documents is attached.
Crash report — sent by you, from your own email app	Only after a crash, and only after you read the report and choose to email it	A description of the crash with file names and paths removed. The app itself transmits nothing — it opens the report in your mail client and you press send, or discard it.

That is the entire table. A network monitor attached to the app at any other moment observes no outbound traffic.

What is stored, and how

Documents are read in place, never copied. Removing one from Parchwell removes index entries only; your file is never touched.
The index is encrypted at rest. Extracted text, embeddings, conversations and the audit trail live in one database encrypted with a key held by your Mac.
Work is partitioned into engagements. A question asked in one client's engagement can only be answered from that engagement's documents — enforced in the database query, not just the interface.
An append-only, fingerprint-chained audit log records every document indexed, question asked and answer given. Edits or deletions break the chain visibly. Exportable.

Verify it yourself

Firewall test. Deny the app all outbound network access with an outbound firewall. Everything except the optional model fetch keeps working: importing, indexing, questions, answers, deliverables, export. That is the claim, and this is the test.
Audit chain test. Export the audit log and re-compute the hash chain; the export format documents how. Tampering breaks the chain visibly.
Storage test. The in-app "Your data" screen lists everything stored with real paths and sizes. Erase it all, then let it re-scan the disk and show you it is gone.

Planned — decided, not built

None of the following exists in the product. Each will require your explicit action, and each will move into the egress inventory above only when it ships.

Secure cloud assist (off by default, chosen per engagement) is planned: the on-device AI will write a masked summary — names, numbers and identifiers replaced on your Mac — and when it ships, only that summary will go out, shown to you byte-for-byte first and recorded in the audit log.
Licence refresh will fetch a renewed licence key when online, carrying the licence id and nothing else. A fully air-gapped annual licence will exist for machines that can never connect.
Support requests and anonymous feedback will be composed locally and sent only when you press send. Anonymous feedback will carry no identifier of any kind.

Being straight with you: Parchwell is in development and not yet for sale. This page will change as those features ship — never before.

Questionnaire quick answers

Where is customer data processed and stored?: On the customer's own machine, exclusively.
Is customer data used to train AI models?: No. Nothing is transmitted to train anything.
What subprocessors exist?: None in the shipped product. Planned cloud assist will add an inference provider under an enforced zero-retention configuration, disclosed before use.
How is data deleted?: By the customer, on-device, verifiably — erase, then re-scan.
SOC 2 / ISO 27001?: Not certified. The architecture keeps data on the customer's machine, which makes most hosted-service controls inapplicable; this page and the in-app verification paths are the evidence we offer today.

Questions this page doesn't answer: privacy@parchwell.com.