Don't trust us. Test us.
Verified offlineYou're being asked to run a brand-new, closed-source app from a company you don't know — on your most sensitive documents. You should not take our word for anything.
With a security tool, trust is earned by behavior, not asserted in copy. So we built ScopePack to be checked: cut its network, run a full briefing, and watch it hold at 0 sent / 0 received.
Turn the internet off. Watch it work anyway.
Drop in a confidential file. Build the briefing while the counter stays at zero. If it ever moves off zero during normal use, we've failed the test in front of you — that's the point.
Airplane mode, or block it harder
Turn on airplane mode. Or leave Wi-Fi on and explicitly block ScopePack with Little Snitch or your firewall. Now the app has no path to the internet, no matter what it tries.
Sources, timeline, entities, findings
Load a document set — the demo set or your own files — and build a complete Sensitive Briefing Pack. The whole workflow runs on-device.
Redact and write a safe copy
Review the sensitive findings, redact, and export to Markdown — including the redacted, safe-to-share version. End to end, network still off.
The counter still reads 0 sent · 0 received
Every feature worked. No connection opened, no byte left your machine. You just proved the privacy claim yourself — no marketing required.
Downloading a local model is the only action that needs the network. It is off by default and only runs if you deliberately turn air-gap mode off to fetch a model. Once a model is on your machine, all analysis runs offline — so the test is honest: everything except that one explicit download must pass at 0 sent.
Behavior, then source, then the signed build.
The runtime test is enough for most people. Reviewers can go two layers deeper — auditing exactly where the code can reach the network, and cryptographically verifying that the build they ran is the audited one.
Watch what it actually does
Run ScopePack with the network cut. Add documents, build the briefing, export Markdown. Every core feature works offline and the top bar holds at 0 sent. The only thing that should ever need the network is the explicit, default-off model download.
Exactly one network code path
We publish a source-level egress audit: a review of every place the code can open a network connection. There is exactly one — the optional model download — and it is off by default. The audit result is hashed and signed into the release manifest, so you can confirm it matches the build you ran. No telemetry endpoint, no analytics beacon, no phone-home.
A signed, verifiable build
Each release ships a proof package next to the binary: a signed manifest, build hashes, an SBOM, the egress-audit result, and a threat model. A public MIT-licensed verifier validates the detached signature, recomputes the SHA-256 of the build, SBOM, and egress audit against the manifest, and confirms the offline workflow runs with no connectivity.
What's in the release proof package
Everything you need to confirm the app you downloaded is the exact one we built, audited, and signed — generated from a single commit.
Version, platform, artifact name, and SHA-256 hashes — with a detached signature you verify against our key.
For the binary, the SBOM, and the egress-audit output. Recompute locally; if they match the signed manifest, nothing was tampered with.
A software bill of materials listing the components that went into the build, so reviewers can see exactly what's inside.
The Layer 2 finding, hashed into the manifest and pinned to this exact build.
What ScopePack protects against and what it does not — so you judge it against your real risk, not a marketing absolute.
Proprietary, but auditors and organization customers can review the source separately. Closed source doesn't have to mean unverifiable.
The verifier is open and MIT-licensed — read it, run it, confirm it does exactly what we say. No trust required.
Explained for a buyer — and for a reviewer
The same fact, said two ways. Deciding whether to trust it? Read the left. Auditing it? Read the right.
In plain English
- The runtime test: unplug the internet, do real work, and the sent / received meter never moves off zero.
- The egress audit: there is one and only one spot in the app that can talk to the internet — an optional model download you choose to run.
- The release proof: a free, open tool confirms the app you got is the genuine, audited one and that it works fully offline.
For a reviewer
- The runtime test: sandbox or firewall the process; observe zero outbound sockets across create → ingest → analyze → export. The on-screen counter is corroborated by your own packet filter.
- The egress audit: a source-level review enumerating all network call sites; result hash committed to the signed manifest, pinned to the build commit.
- The release proof: verify the detached signature over
manifest.json, recompute SHA-256 over the artifact, SBOM, and egress audit, and confirm the offline workflow executes with no connectivity.
What we deliberately can't do
The strongest privacy isn't a promise to behave well — it's not being able to misbehave. ScopePack is built so the data never reaches us, which means we can't do these even if asked.
No usage, events, or errors reported back to us. There's no stream to read because there's no stream.
No analytics SDK, no tracking beacons, no "anonymous" metrics. Your activity isn't measured by anyone but you.
The core workflow has no sign-in, no profile, no sync. Purchase and support run through Stripe and email only.
Your documents stay in encrypted local storage. There is no server-side copy to breach, retain, or seize.
A hosted service can be compelled to disclose what sits on its servers. We never receive your data — so your documents stay on your machine, and there is nothing for us to be forced to hand over.
ScopePack is a private workspace and operator aid for reviewing your own documents. It is not legal, security, or compliance advice, and is not a tool for evading lawful obligations. You remain responsible for how you handle your files and for reviewing every output before relying on or sharing it.
Run the test. Then lock in pilot access.
Don't take this page's word for it either. Cut the network, build a briefing, and watch the counter stay at zero.
- Full local briefing workflow
- Timeline, entities, sensitive findings
- Redaction & safe-to-share export
- Verification report on every pack
- 1 year of updates · yours to keep forever
- Everything in individual
- Set up for a small team
- Onboarding call included
- Priority roadmap influence
- 1 year of updates · yours to keep forever
30-day refund, no questions asked. Manually onboarded — please don't email sensitive documents. Read why we built it →