PRIVACY ARCHITECTURE

A privacy tool that kept your data would be a contradiction.

BALMAS exists so sensitive documents never reach AI services. The same standard applies to us: Zero-Retention Processing, by architecture — not by policy document.

DOCUMENT LIFECYCLE
⇪
Upload
The file opens in YOUR browser — it is never sent to a server
→
⌕
Local scan
Deterministic detection runs on-device
→
☑
Review
You approve every replacement
→
⇣
Clean copy
Downloaded once, straight to your device
After download: original, preview and replacement map — deleted. Retained: 0 bytes.
NEVER — BY DEFAULT
✕Use your files to train models
✕Store document contents in analytics
✕Keep prompt or document logs
✕Keep the preview after the session
✕Keep the "Original → Replacement" map
ALWAYS
✓Deterministic detection runs without external LLMs
✓TLS 1.3 in transit for everything that does travel (counters only)
✓Automatic deletion at end of session
✓Audit logs store event types only — never contents
✓Metadata cleaning: Author, Comments, Track Changes
✓Secrets (API keys, passwords, private keys) replaced at every level — never restored into free text

Choose your deployment boundary

CLOUD

BALMAS Web

In-browser processing served from our cloud. Files never leave your device; our servers see anonymous counters only. The default for individuals and teams.

PRIVATE CLOUD / ON-PREM

Self-Hosted

BALMAS runs inside your environment. Nothing crosses your network boundary. For organizations with governance requirements — talk to us.

LOCAL MODE

BALMAS Desktop

Windows / Mac app. The document never leaves the device — 0 bytes to cloud. For the most sensitive organizations.

See Desktop →
AI AGENTS · BETA

Agent Gateway (balmas-mcp)

A local MCP server between AI agents and your files: agents receive cleaned copies — read-only, folder-allowlisted, all processing on your machine.

See the gateway →

Sensitive data stops here.

Try it on a real document — it never reaches our servers in the first place.

Clean a File — Free