The direct answer: yes, your document content stays local, and here is how to confirm it yourself
If you are asking whether on-device AI security claims hold up, here is the direct answer: with Apioni, your document content stays on your own computer, and the only outbound internet connection the app makes is a version check to apioni.com at launch that carries no document content. You do not have to take that on faith. This article gives you a concrete, repeatable method to verify that local AI sends no data, using nothing more than your network settings, a standard command-line tool, and an in-app self-check. If you handle confidential files and need to know whether local AI is really private, you can confirm it yourself in a few minutes.
Apioni is an on-device document AI desktop app. It runs an on-device large language model (Ollama with a Qwen3-family model) and a local embedding model (bge-m3) directly on your machine, and it works without an internet connection.
Why "trust us, it's private" is not enough for confidential documents
If you work with legal filings, tax records, financial statements, patient data, or public sector documents, you already know that a vendor saying "your data is safe" is not something you can put in a compliance review. Security reviewers ask for evidence, not adjectives. Many cloud AI tools retain prompts and uploaded files for logging or model training, sometimes in ways that are easy to miss in a terms-of-service document.
The honest position is that you should not have to trust any vendor's word, including ours. Trust should come from verifiability. The rest of this article is about how to replace assurance with proof you can reproduce.
What "on-device" actually means in Apioni: local LLM, local embeddings, localhost only
On-device means the AI model runs on your own computer rather than on a remote server, so the documents it reads are processed locally. In Apioni, both the language model and the embedding model run on your hardware.
Here is how it works. You connect a folder of documents. Apioni indexes them locally, then answers questions, summarizes, and drafts documents while citing the source passages it used. Retrieval uses hybrid search, which combines keyword search (BM25) with semantic search and fuses the two result sets using Reciprocal Rank Fusion (RRF). All of this computation runs against the local engine on your machine, reachable only at localhost.
The practical consequence is simple to state: all document processing goes only to the local engine on your machine, and your document content never leaves your computer.
Verification 1: turn off the internet and keep working
The fastest test requires no technical tools at all.
- Open Apioni and connect a folder of documents so it can index them.
- Disconnect from the internet. Turn off Wi-Fi, unplug the Ethernet cable, or enable airplane mode. This puts your machine on an effectively air-gapped footing, meaning it has no active network path to the outside.
- Ask Apioni questions about your documents, request a summary, or have it draft something.
It keeps working. Indexing, retrieval, question answering, and drafting all continue with no internet connection, because the model and your documents are both on the machine. A tool that secretly depended on sending your content to a cloud service would fail this test. Apioni does not.
Verification 2: inspect live connections with lsof (and the Windows equivalent)
If you want to watch the network behavior directly, you can list the live connections the app holds open.
On macOS or Linux, open a terminal and run:
lsof -i -P | grep -i apioniThis lists the open network connections associated with the app. While you index documents and ask questions, you will see connections to localhost, your local engine, rather than a stream of outbound traffic carrying your files to an external host.
On Windows, you can use the built-in Resource Monitor (open resmon, then go to the Network tab) or run netstat -b in an elevated command prompt to see which processes hold which connections.
Verification 3: run the in-app network self-check
You do not need to be comfortable on the command line to verify Apioni. The app includes a built-in network self-check that reports its own network behavior, so you can see what the application contacts without leaving the interface. This is intended for exactly the reader who wants confirmation but does not want to interpret raw lsof output, and it gives a compliance reviewer a straightforward artifact to look at.
The one connection we do make: the launch version check
Honesty matters more than a clean marketing line, so here is the one outbound connection Apioni makes. When the app launches, it contacts apioni.com to check whether a newer version exists. That is the entire purpose of the request. It carries no document content, no file names, and no contents of your indexed folder. It only asks whether an update is available.
We disclose this openly because a blanket claim that "nothing ever leaves" would be false, and a false claim is worse than no claim for anyone doing a serious security review. A single version check with no document payload is something you can confirm yourself using the two verification methods above: it appears at launch, it goes to apioni.com, and it does not recur as you process documents.
What we deliberately do not do: no document upload, no usage telemetry
To be precise about what is absent:
- No document upload. Your files and their contents are never sent to an external server or cloud.
- No usage telemetry. Apioni does not phone home with analytics about how you use the app, which documents you open, or what you ask.
These are not features you have to enable or settings you have to harden. They are the default behavior, and they are verifiable with the methods above.
Comparison: cloud AI vs on-device AI on data location, outbound connections, and verifiability
| Aspect | On-device (Apioni) | Typical cloud AI |
|---|---|---|
| Where document content goes | Stays on your machine (localhost) | Uploaded to external servers |
| Works without internet | Yes | No |
| Outbound connections | One version check at launch, no document content | Document content sent per request |
| Usage telemetry | None | Often present |
| Can you verify it yourself | Yes, via offline test, lsof, and in-app self-check | Generally not, you rely on the provider's policy |
| Pricing | One-time KRW 39,000, company-wide license, no device limit | Recurring subscription, often per seat |
Who this matters most for: legal, tax and accounting, finance, public sector, healthcare and research
The need to verify rather than trust is sharpest for people who handle documents they simply cannot upload to a general cloud AI tool:
- Legal. Privileged filings, contracts, and case material.
- Tax and accounting. Client financial records and filings under confidentiality obligations.
- Finance. Internal statements, deal documents, and customer data subject to regulation.
- Public sector. Records that cannot leave controlled environments.
- Healthcare and research. Patient information and unpublished data with strict handling rules.
- Corporate security. Teams that must justify any new tool to a security reviewer before adoption.
For all of these, the value of Apioni is not only that it is local, but that you can demonstrate it is local to whoever needs the proof.
Try it and verify for yourself: start the 14-day free trial
You do not have to decide based on this article. Run the checks above on your own machine, with your own documents, and confirm the behavior yourself.
Apioni is a one-time purchase of KRW 39,000 with a company-wide license and no device limit, so a single purchase covers your team. There is a 14-day free trial that requires no card or payment details, so you can complete every verification step before spending anything.
Download Apioni and start the free trial, or see pricing and buy.
Frequently asked questions
Does Apioni work completely offline?
Yes. Apioni runs an on-device LLM and a local embedding model on your own computer, so indexing, search, question answering, and drafting all work without an internet connection. You can confirm this by disconnecting from the network and continuing to use the app.
If the app checks for updates, could my documents be sent too?
No. The launch version check to apioni.com only asks whether a newer version exists. It carries no document content, no file names, and no folder contents. You can verify this with lsof or the in-app network self-check: the version check appears at launch and does not recur as you process documents.
How do I prove this to my security or compliance team?
Use the three verification methods together. Show that the app keeps working with the internet disconnected, capture the live connection list with lsof (or Resource Monitor on Windows) during real document processing, and run the in-app network self-check. Together these give a reviewer reproducible evidence that document content stays on the machine.
What data, if any, does Apioni send to your servers?
The only outbound connection is the launch version check to apioni.com, which carries no document content. Apioni includes no usage telemetry, so it does not send analytics about your activity, your files, or your queries.
Do I need a subscription, and is there a trial?
There is no subscription. Apioni is a one-time purchase of KRW 39,000 with a company-wide license and no device limit. A 14-day free trial is available with no card or payment details required, so you can run every verification step before buying.