AnonymFilesOffline anonymization software: what "local" really means
Offline anonymization software masks the personal data in a document on your computer, without sending anything over the internet: not the document, not a license call, not usage statistics. Yet many so-called "local" tools still use the network; here are the five levels of "local", the eight questions to ask and how to check for yourself.
What is offline anonymization software?
It is an application installed on your computer that finds the names, addresses, numbers and other personal data in a document, replaces or deletes them, and produces a copy you can share, without ever sending the document over the internet. It is the opposite of online services, where you upload the file to a website that anonymizes it on its servers.
The difference is not a matter of taste. To anonymize a document online, you first have to send it in clear text: the provider receives the names before removing them. Offline software avoids that first transfer. That is why professions bound by secrecy look for it, under many phrasings: "local anonymization software", "anonymize without internet", "anonymization without the cloud", "offline anonymization tool".
"Offline" also has to be true. Software can process the document on the computer and, alongside, call a server for its license or send usage statistics. It is not the document that leaves, but it is a connection the firm needs to know about, document and often allow through its firewall.
The six places where "local" software can still go online
Six functions can use the network in software that otherwise processes documents on the computer.
| Function | What can go over the network | The risk |
|---|---|---|
| Document processing | The text or file sent to a detection API | The most serious: the content leaves in clear text |
| Detection models | Models downloaded at first launch or with each update | Low if no text leaves; blocking on a computer without internet |
| License | Online activation, check at launch or periodically, device identifier | A recurring connection to document; the software may stop working offline |
| Updates | Automatic check for new versions | One more connection, often silent |
| Telemetry | Usage statistics, crash reports | A crash report can contain excerpts of the document being processed |
| Built-in AI | Chat, summary or agent calling an online model | What you send there leaves the computer, even anonymized |
None of these functions is forbidden as such. But a firm that picks "offline" software to protect secrecy needs to know which ones exist, and vendors do not always spell them out.
The five levels of "local"
From least to most protective, five situations exist on the market.
| Level | What happens | Does the document leave the computer? |
|---|---|---|
| 1. Online service | The file is uploaded to a website that anonymizes it on its servers | Yes, in clear text, before anonymization |
| 2. Local with online services | Processing on the computer, with a web app, an API or remote integrations alongside | Not for local processing; yes for what you send to the online services |
| 3. Local, license checked online | Processing on the computer, but the license is checked at launch or at regular intervals | No, but the software contacts a server regularly |
| 4. Local, one-time activation | A brief connection to activate the license, then nothing | No; a single connection, at installation |
| 5. 100% offline, license included | No account, no license call, no telemetry: the software works in airplane mode from installation | No, and no connection is needed |
Where the tools on the market stand
Based on what each vendor publishes on its website, as of October 14, 2026. Prices, formats and other criteria are detailed in our comparison of anonymization software; links to each website are in the sources.
| Tool | Processing | What still goes over the network, per the vendor | Level |
|---|---|---|---|
| PrivaDoc | Online service hosted in the European Union | The document is uploaded to the service; "the encrypted mapping stays on the server side" (our translation) | 1 |
| Lexanon | On the computer | Online license activation, then validation "carried out monthly" (our translation); optional integrations with online AIs: "the content you choose to send leaves the computer" (our translation) | 3 |
| Hexagone AI | On the Mac or PC | Periodic "heartbeats" (our translation) to check the license and anonymous usage counters (also sent to PostHog, hosted in the EU), models downloaded at first launch; optional web app and API hosted in Europe | 3 |
| Occlira | On the device | Online activation, license re-checked "at launch and every few hours", 14-day offline grace period, locked to one device | 3 |
| Anoni | On the device | Engine downloaded at first launch; email requested at activation, license check at launch, one opening reported per day (can be turned off) | 3 |
| Tacitum | On the Windows PC | Brief connection for activation: "only the key is checked" | 4 |
| AnonymFiles | On the computer | Nothing on Mac. On Windows, a one-time model download on first use, with no document text. License checked on the computer, with no account and no network call | 5 on Mac; 5 on Windows after the first run |
Open-source building blocks such as Microsoft Presidio or Stirling PDF depend on how you install them: they can run offline, but they are components to integrate or PDF editors, not anonymization software ready for a firm. This table only reflects what vendors write; ask them the questions below before buying.
Why it matters for professional secrecy
For a French lawyer (avocat), notary, chartered accountant or commissaire de justice, this is not a technical question. Article 226-13 of the French Criminal Code (Code pénal) punishes the disclosure of secret information with "one year's imprisonment and a fine of €15,000" (our translation). Sending a document in clear text to an online service means handing it to a third party, wherever it is hosted.
The French bar council put it in writing. In its assessment grid on artificial intelligence (June 2025), it names only two ways to eliminate sovereignty risks and guarantee confidentiality: "full prior anonymization of the data", or a model installed on the firm's own instances (p. 11). Anonymization done before sending requires a tool that transmits nothing itself. Our summary of the CNB's AI guide details these criteria, and our page on AI and professional secrecy covers each profession.
Local software that checks its license online does not send the document: it does not breach secrecy. But it forces the firm to allow a recurring outbound connection, and it may stop working on a computer cut off from the network. For a firm that keeps some computers offline, that is a deal-breaker.
8 questions to ask a vendor
Before buying anonymization software sold as local, ask these eight questions in writing and keep the answers in the firm's compliance file.
- Does the document leave the computer, even encrypted, even for a moment? The only right answer is no.
- Are the detection models included, or downloaded? If downloaded, when, from which server, and does the download contain any document text?
- Is the license activated or checked online? How often, and what happens on a computer without internet?
- Is there telemetry, usage statistics or crash reporting? Can they contain an excerpt of the document?
- Are updates automatic? Does the software check for new versions on its own?
- Does any feature go through a cloud? Chat, summary, OCR, integration with ChatGPT or Claude.
- Where is the mapping table stored, and is it encrypted? Reversible pseudonymization keeps the real names somewhere: on the computer or at the vendor's?
- Can I check it myself? A serious vendor invites you to turn off Wi-Fi or monitor connections.
These questions complement the criteria in our guide to choosing anonymization software.
How to check for yourself that software sends nothing
Three tests, from simplest to most thorough.
- Airplane mode. Turn off Wi-Fi and unplug the network cable, then process a test folder. Truly offline software gives the same result as online. If it asks for a connection, you have your answer.
- The connection monitor. On a Mac, Activity Monitor (Network tab) shows the data sent by each application; on Windows, Resource Monitor (Network tab) lists connections by process.
- The outbound firewall. An application firewall such as LuLu, free and open source on Mac, flags every outbound connection attempt and lets you block it.
A connection to 127.0.0.1 (the computer itself) does not leave: it is an exchange between two programs on the same machine. Our article on the AnonymFiles detection benchmark and offline test details the procedure step by step.
AnonymFiles: what does, and does not, go over the network
AnonymFiles is French document anonymization software, coming soon for Apple silicon Macs and Windows, built for professions bound by secrecy. Here is what it does on the network, according to its code.
- Documents: never sent. Detection, redaction, review and putting the real names back all happen on the computer.
- Detection models: included in the app on Mac. On Windows, they are downloaded once, on first use, at a pinned version checked by hash, as are the OCR language files; no document text leaves.
- License: a signed key checked on the computer, with no account and no network call. A 14-day trial works the same way.
- Telemetry and updates: no telemetry, no automatic update check.
- Mapping table: on the computer, encrypted at rest (AES-256-GCM), never in the export.
- AI agents: a local bridge on 127.0.0.1 lets agents installed on the computer read only the approved copies; it never leaves the computer.
The security and network scope page covers these points. Feature-wise, AnonymFiles processes a whole case file: text and scanned PDFs (local OCR), images, Word, .eml and .msg emails, .xlsx and .csv spreadsheets, .pptx presentations. Price: €290 excl. VAT per seat per year for one or two seats, €240 excl. VAT per seat from three seats, with no page quota.
FAQ
What is offline anonymization software?
It is software installed on your computer that finds and masks the personal data in a document without sending it over the internet. Truly offline software needs the network neither to process the document, nor for its detection models, nor to check its license: it works in airplane mode.
Is there anonymization software that works without internet?
Yes. Several tools advertise local processing, such as AnonymFiles, Anoni, Tacitum, Occlira, Hexagone AI and Lexanon. They differ in what still goes over the network: model downloads, license activation or checks, integrations with online AIs. AnonymFiles checks its license on the computer, with no account and no network call, and ships its models on Mac.
Is local anonymization software free?
Some is, such as Anoni, which still checks its license at launch, or open-source building blocks like Microsoft Presidio that you integrate yourself. Software built for firms is paid: AnonymFiles costs €290 excl. VAT per seat per year, €240 excl. VAT per seat from three seats, with no page quota.
How can I check that anonymization software sends nothing?
Turn off Wi-Fi and process a folder: truly offline software gives the same result. Then watch connections with Activity Monitor on a Mac, Resource Monitor on Windows, or an outbound firewall such as LuLu. Only local connections to 127.0.0.1 may appear, and they never leave the computer.
Is an online anonymization tool hosted in France enough for professional secrecy?
No. To anonymize online, you first have to send the document in clear text to a third party, even one hosted in France or the European Union and encrypted. Professional secrecy forbids disclosing the information to any third party; local software avoids that transfer.
Does AnonymFiles work offline on Windows?
Yes, after a first run. On Windows, the detection models and the OCR language files are downloaded once, on first use, at a pinned version checked by hash, with no document text. After that, everything works without a connection. On Mac, the models are included: no connection is needed.