Web scanner
PDF and DOCX parsing and detection run in the loaded browser tab. The scanner does not send the document, extracted text, or findings to the Strike Gate API. The free-demo counter is a separate request described below.
Security and data flow
Verify local scanning
Strike Gate uses one detection engine through five access methods. Document processing is local, but the surrounding network requirements differ by method. This page describes the current implementation—not a security certification or authorization to process classified material.
Use the public web demo with synthetic documents only. Before using any interface with real controlled or classified material, confirm that your organization has approved that method and environment.
Where scanning happens
What stays local during a scan
For the methods below, Strike Gate runs the detection locally and does not send the document or extracted text to its scanning API. Hosted assets, free-demo accounting, purchases, and connected AI clients are separate network flows.
Word and Outlook add-in
The add-in's task-pane code is served from Strike Gate and needs a connection to load. Document and email checks run in the Office add-in context. Outlook's send-review flow can temporarily store findings and attachment summaries in local browser storage.
Browser extension
Supported files and eligible pasted text are passed between the page script and the extension's local service worker for scanning. The extension keeps up to 50 recent scan summaries in browser session storage, including filename, result status, time, and page URL; it does not store the document text there.
CLI
The built CLI reads the selected files on the machine, scans locally, and writes output to the terminal or a local report file. It makes no runtime network request; source and dependencies must be acquired before an offline build.
MCP server
The MCP server runs as a local process. Its stdio transport stays local; its optional HTTP transport is loopback-only. An AI client may send its prompt or the returned findings to its own provider, outside Strike Gate's control.
What does use the network
Expected network activity
A local scan does not mean every part of the product is offline. These are the current non-scan flows to account for.
Free web-demo allowance
The browser requests /api/demo/status and /api/demo/consume so the server can maintain the three-scan allowance. A random classiscan_demo_id cookie identifies that demo counter. These requests do not include a document, extracted text, findings, or document metadata.
Purchases and license delivery
Checkout sends the selected package, email, optional name/organization, and license allocation to the Strike Gate API. The API validates the purchase and sends payment and contact/package metadata to Stripe; card details are entered and processed by Stripe. The API creates the signed license and stores purchase records. If email delivery is enabled, the recipient address and license attachment are sent through Resend. These flows do not include scanned documents or results.
Hosted pages and updates
The web scanner and Office add-in download their app assets from Strike Gate's hosted site. The browser extension is installed from a package, and CLI/MCP builds are updated by obtaining a new build. The CLI and MCP scan path do not check for updates at runtime.
Analytics and service logs
The frontend has no analytics SDK or scan-event telemetry. The API records basic operational request metadata (request ID, method, path, and status); delivery/error logs may also contain purchase or email-delivery identifiers. No document content or extracted text is included in those logs.
Connected AI tools
A local MCP server does not make a cloud AI client local. If the connected client uses a remote AI provider, that provider may receive prompts and MCP results under its own terms and settings. Use an approved local client/provider for disconnected or classified workflows.
Purchasing sends contact and transaction information—not scan content—to payment and delivery services. See the Privacy Policy for the broader data-handling summary.
Local persistence
What may remain on the device
“Local” does not always mean “nothing is stored.” These limited records support licensing or review and remain on the device or browser profile.
Web scanner
Paid license files and local credit balances stay in the browser's local storage/database. The free-demo count is server-maintained. Scan inputs are processed in the tab and are not saved as a server-side scan history.
Browser extension
The extension's session history contains a limited summary (filename, status, level, time, and source page URL). Clear it from the extension's history control; it is browser-local and is not sent to Strike Gate.
Outlook add-in
The send-review handoff may temporarily place findings and attachment summaries in localStorage on the add-in origin so the task pane can display them. That local handoff can include matched text; it is not uploaded to Strike Gate and is cleared when the task pane processes it.
CLI and MCP
The CLI writes reports only where you direct it. The MCP server returns findings to its local client; whether that client forwards them elsewhere depends on the client/provider configuration.
Verify it yourself
Check the web scanner in DevTools
Use the synthetic sample, not a real sensitive document. Keep the Network panel open while scanning.
- Open developer tools and select the Network tab. Clear the request list before the test.
- Scan one of the fictional sample files in the public web app.
- Look for the web app’s page assets and, for the free demo, the same-origin
/api/demo/statusand/api/demo/consumerequests. - Inspect request details: the demo requests maintain the scan count; they do not carry the sample file, extracted text, or findings.
Chrome and Microsoft Edge
Open DevTools with F12 or Ctrl+Shift+I (Windows/Linux), or ⌘⌥I (Mac). Choose Network; use Fetch/XHR to focus on API requests, then switch back to All to review page assets.
Firefox
Open Developer Tools with Ctrl+Shift+E (Windows/Linux) or ⌘⌥E (Mac), then review the Network panel.
Safari
Enable Show features for web developers in Safari settings if needed. Open Develop → Show Web Inspector, select Network, and run the synthetic sample.
Extension-to-background messages are internal browser messages, not web requests. The Office add-in downloads its task-pane code from Strike Gate; that asset traffic is separate from local document scanning.
Limitations
Local screening is not a security boundary
Detection is pattern matching, not a classification determination. Results can be missed, misidentified, or incomplete when a file is unsupported, encrypted, malformed, or a scan fails. Some integrations allow a user to override a warning or continue after a scan error.
Do not rely on Strike Gate alone to prevent disclosure. Apply your organization’s handling rules and have an authorized person review findings. Results are comparable when engine versions, detection rules, and scan settings match; method-specific parsing can still affect input.