# Privacy model (what an agent can promise the user)

1. **No uploads, no network.** Neither the MCP server nor the CLI opens a network connection. They read and write local files only. On the web app the browser enforces the same thing through `Content-Security-Policy: connect-src 'self'`.
2. **Anonymization happens before anything leaves the machine.** The recommended flow for cloud models is: `pdf_to_markdown` (anonymized) → send placeholders to the model → map answers back locally with `anonymize_text`'s `include_mapping`.
3. **Consistent pseudonyms.** The same value always maps to the same placeholder inside one call, so structure and references survive.
4. **It is rule-based.** Detection is deliberately aggressive (false positives are cheap, false negatives are not) but it can miss unusual formats. For sensitive documents, tell the user to review the output.
5. **Nothing is retained.** No cache, no logs of document content, no telemetry. Files written by `merge`/`split`/`compress` go exactly where the user asked, and existing files are never overwritten without an explicit flag.
6. **Verifiable.** The web app ships a live outbound-traffic meter and a page explaining four checks anyone can run: https://sirdas.app/en/privacy/