Privacy & your data
Where your documents are processed, when content may reach a provider, and how to control it.
Scanix Desktop is built so your documents stay on your machine by default. This page explains where each part of the work actually happens, the one place content can leave your computer, and the controls that keep you in charge of it — so you can reason about data handling before you wire Scanix into a sensitive workflow.
The short version
Scanning, image enhancement, and OCR all run locally on your computer. You don't need a Scanix account to process documents — capture, clean up, read, verify, and export work without one. The only time document content can leave your machine is if you connect a cloud AI provider and let a document be sent to it. Everything else, including anonymous usage telemetry, stays off or stays on-device unless you turn it on.
Local by default
Scanix processes documents locally. The OCR engines run entirely offline once their language models have downloaded, and no document content is sent anywhere unless you choose a cloud AI provider for a job.
Where each stage runs
It helps to map data handling onto the pipeline a document moves through — Capture → Enhance → OCR / AI → Verify → Export. Most of those stages never touch a network.
| Stage | Where it runs |
|---|---|
| Capture — scan, import, drag-and-drop, watched folders | On your machine. |
| Enhance — straighten, crop, colour handling | On your machine. |
| OCR — recognise the text | On your machine, offline (after models download). |
| AI — classify the document and fill named fields | On-device, or your own cloud provider — your choice. |
| Verify — review extracted fields | On your machine. |
| Export — write results to formats and destinations you pick | To the destinations you configure. |
The single stage with a cloud option is AI capture. Capture, enhancement, OCR, verification, and the storage behind them all stay on the device. For the full tour of the pipeline, see How Scanix works.
AI: your choice of on-device or your own cloud
AI capture — the part that classifies a document and fills named fields — is the one place where document content can go to a third party, and only on terms you set. There are two ways to run it, and you decide which.
Install a local model and AI capture runs natively on your computer. Document data never leaves the device, which makes this the right fit for HIPAA / PHI and other data-residency workflows. No account, no key, no network call for the AI step.
Connect your own provider key (Anthropic or OpenAI) and AI calls run straight from your machine to your own provider account, under your own contract. Scanix is never the account holder and never receives, transmits, or stores your key.
This is what "bring your own cloud" means: when you use a cloud provider, the relationship is between you and that provider. Scanix hands the request off from your computer; it does not proxy your documents through a Scanix server.
Screenshot
A diagram contrasting the two AI paths: an on-device path that stays inside the computer, and a bring-your-own-cloud path going from the computer straight to the user's own provider account. — shot concepts-privacy-and-data-01
Keeping content on-device: Local-only mode
If your policy is "nothing leaves this machine," you don't have to rely on remembering to pick the right provider every time. The Local-only mode (no cloud egress) toggle in Settings → AI Services, under Privacy & fallback, is a hard stop: it blocks every AI service from sending document content to a cloud provider, regardless of any per-group or per-template routing. It's designed as an enterprise data-residency guardrail — once it's on, a routing choice elsewhere can't override it.
Routing policies give you finer-grained control for mixed setups. Local only never sends documents to the cloud; Local first tries on-device and only escalates to the cloud if the on-device result fails verification; Cloud only always uses a configured cloud provider; and Pinned always uses one fixed provider and model you choose, for reproducible, audit-friendly runs. The provider option On-device (local) likewise keeps a job's AI step on the machine with no cloud egress.
Cloud egress is opt-in, by design
Cloud AI only happens when you've connected a provider key and a job's routing actually sends content there. Turn on Local-only mode to remove cloud egress as a possibility entirely, no matter how individual jobs are configured. See AI providers, routing & privacy for how routing and egress fit together end to end.
Anonymous usage telemetry is off by default
Separate from your documents, Scanix can collect anonymous product-usage telemetry — but only if you opt in. The Privacy tab in Settings controls it through a single Anonymous usage telemetry choice, and it is off by default: nothing is sent until you choose Opt in — share usage data. You can change your mind at any time, and the choice saves instantly.
Crucially, telemetry never includes what's in your documents. The tab states it plainly: No document content, file names, or customer-supplied text is ever sent.
| Sent (only if you opt in) | Never sent |
|---|---|
| Event types (for example, OCR completed) | Document content |
| Page counts | File names |
| Durations | Any customer-supplied text |
For where this control lives alongside diagnostic logs and the clear-all-data action, see Updates, privacy & data.
Screenshot
The Privacy tab showing the Anonymous usage telemetry card with its three choices and the line stating no document content, file names, or customer-supplied text is ever sent. — shot concepts-privacy-and-data-02
Your data lives on your machine
Because processing is local, so is storage: documents, batches, and processing jobs sit in Scanix's local database and as files on your disk. You stay in control of removing them — the Data & Storage tab clears all local Scanix data, including the imported files on disk, when you want a clean slate.
Scanning is Windows-only
The in-app Scan button is available on Windows. Importing files and folders and drag-and-drop work regardless of platform support for scanning.
Next steps
AI providers, routing & privacy
How on-device inference, cloud routing, and egress fit together end to end.
Updates, privacy & data
Telemetry consent, diagnostic-log caps, and clearing all local data.