Trust centre

We do not protect your files in the cloud. They never go there.

"Bank-level encryption in transit" is an answer to the wrong question. A document that leaves the machine has left your control, whatever happened to it on the way. Oxofolio does the work where the file already is — and every claim on this page is one you can check yourself in about ten minutes.

Read the security pack → How to verify it

The network position

No telemetry, no update check, no licence call-home.

Stated as four separate things because vendors routinely deny the first and quietly do the other three.

What we do not do	How it is enforced
No document telemetry What you open, how many pages, what you redact	Impossible The application opens no sockets at all, so there is no channel for any of it to travel down.
No usage or feature tracking	Impossible Same reason. There is no analytics library in the shipped source, and a build that imported one would fail.
No licence call-home	By design A licence is an Ed25519 signature verified against a public key compiled into the application. Verification is arithmetic on your machine. There is no activation server and there never will be — one would contradict the product.
No update check	By design The application never asks whether a newer version exists. You update it when you choose to, from the download page.
Nothing is fetched at runtime	Bundled The Python sidecar and the OCR engine ship inside the installer and are the only executables launched. Nothing is downloaded, ever.

The one qualification

Two links, and what happens when you click one.

The interface carries two links to this website — a feedback form and a research survey. Activating one hands the address to your operating system, which opens your own browser.

That browser then makes a request, and we can see it. The visit reaches our web server with your IP address, and a marker telling us it came from an installation rather than from the site. The application itself still opens no connection, and nothing about your documents is in the address.

We set this out because a page claiming "no network connections of any kind" while that existed would be answering the wrong question — and because a reviewer would find it anyway.

What it means in practice

The renderer cannot ask for an arbitrary address to be opened. The two addresses are held in the main process and referred to by name.
Blocking outbound traffic on the host does not affect the application. The links simply fail to load in the browser, and every feature keeps working.
Nothing is transmitted by the application itself in either case — the request is made by your browser, to a page you chose to open.

Don't trust us

Audit us. It takes about ten minutes.

Every claim above is checkable on a machine you control, without our help and without telling us you are doing it. No web-based competitor can offer the same test.

◔

The ten-second version

Open Oxofolio, then run netstat, Activity Monitor or Resource Monitor while it is working. Nothing is listening and nothing is dialling out.

◍

The packet-capture version

Start Wireshark on the machine. Point Oxofolio at a folder, unlock a batch of protected statements, compress them, redact identifiers and export. Filter for the process. There is nothing to see.

✂

The unplugged version

Pull the network cable, or block the application at the firewall, and do a full day's work. Every feature behaves identically, including licensing and OCR.

If a test does not behave as described, we would genuinely like to know — tell us. A claim that cannot survive being checked is not worth making.

Where this lands

What it means for your obligations — and what it does not.

Processing locally removes a whole class of question from a review. It does not make anybody compliant, and we do not sell it as doing so: compliance is a property of your processes, not of a tool.

Framework	What local processing actually changes
DPDP Act, 2023 India	You remain the Data Fiduciary. What changes is that no third-party processor enters the picture for the document work, so there is no processing agreement to hold and no transfer under section 16 to account for.
GDPR EU and UK	We are neither controller nor processor for your documents, so a data processing agreement is not required for the software itself. There is no Chapter V transfer, because there is no transfer. Article 32 asks you to take appropriate measures — this is evidence toward that, not a discharge of it.
Professional confidentiality	The duty in your engagement letter is engaged whether or not personal data is involved. Local processing means no unassessed third party ever holds the file.
Sector rules	We make no claim about HIPAA, PCI DSS or any framework we have not been assessed against. If yours matters, send us your questionnaire and we will answer it in writing.

None of this is legal advice, and no provision cited here has been reviewed by a practitioner on our behalf. What applies outside India covers the jurisdiction question in more detail.

Privacy, in plain English

Four sentences, no defined terms.

We do not want your data

There is no business model here that involves your documents. We sell a licence for software that runs on your machine.

We have no servers that could store your documents

Not "we choose not to" — there is no infrastructure that receives them. There is nothing to breach and nothing to subpoena.

If this company disappeared tomorrow, the app keeps working

Your licence is a signed file your own copy verifies offline. It does not check with anybody, so there is nobody whose absence could stop it.

The website is not the application

This site records downloads and runs analytics if you allow it. The application you install does neither — the full privacy page keeps the two separate.

Everything, in one place

What to hand your reviewer.

◈

Send it over and we will fill it in.

Talk to us →