The short version. Your documents and data are stored on your machine. Your API key is in your OS keychain. AI requests go directly from your machine to your chosen provider. Advisor Prep Hero's servers are not in the data path. With a local model such as Ollama, nothing leaves your machine at all. This page states our current posture honestly, including what we don't have yet.
This page is written for attorneys, CPAs, consultants, and the IT or compliance staff who review tools on their behalf. It covers where data is stored, who can see it, how API keys are handled, what the audit trail looks like, and what certifications and agreements we currently hold (and don't). If you have a specific technical question not answered here, email [email protected].
Advisor Prep Hero stores all your notes, drafts, chat histories, and workspace files as plain files in a folder you choose on your own hard drive. No Advisor Prep Hero server holds a copy.
When you configure a cloud AI provider, Advisor Prep Hero stores your API key in the OS keychain: macOS Keychain, Windows Credential Manager, or Linux libsecret. Keys are never written to a config file in plaintext and never transmitted to Advisor Prep Hero's servers.
When you send a message to a cloud AI provider (Anthropic, OpenAI, Google), the request travels from your machine directly to that provider's API using your key. Advisor Prep Hero's servers are not in this path and never see the content of your prompts or responses.
When you configure Advisor Prep Hero to use a local model (such as Ollama running on your machine), AI inference runs entirely on your hardware. No data reaches any external server. This path is available to any Advisor Prep Hero user and is the appropriate choice for content that must not leave your machine. Note: cloud BYOK keys still send your prompt to the cloud provider; only the local model path produces zero external egress.
If you use Advisor Prep Hero's email import feature, imported messages are encrypted at rest on your device and searchable locally. Email is never routed through an Advisor Prep Hero server.
Advisor Prep Hero writes an append-only log of every AI action: timestamp, model, files included, and output produced. The log lives on your machine, is per-workspace, and can be produced for any matter on request. It is retained as long as your workspace folder exists.
The Advisor Prep Hero desktop app collects no usage telemetry by default. If you choose to enable anonymous usage reporting in Settings, it can be turned off at any time. The marketing site uses Plausible Analytics (no individual tracking, no cookies).
Two paths are possible depending on which AI provider you configure:
Who has a copy: you and the AI provider. Advisor Prep Hero is not in this path.
Your prompts are governed by your chosen provider's API data-processing terms, not consumer product terms. Neither Anthropic nor OpenAI uses API inputs to train models by default. See each provider's current API usage policy for the precise retention and data-handling terms.
localhost:11434 for Ollama).Who has a copy: you. No network call is made.
This is the strictest posture available. Nothing reaches any external server. If your professional obligations, an NDA, or client instructions prohibit any external data transmission, the local model path meets that requirement literally.
| Question | Cloud BYOK (Anthropic / OpenAI / Google) | Local model (Ollama) |
|---|---|---|
| Documents stored on an Advisor Prep Hero server? | No | No |
| API key visible to Advisor Prep Hero? | No | N/A |
| Prompts visible to Advisor Prep Hero? | No | No |
| Data leaves your machine? | Yes, to provider | No |
| AI provider sees prompt? | Yes (under your API account) | No |
| Provider trains on inputs (default)? | No (API tier) | No |
| Audit log on your machine? | Yes | Yes |
| Works offline? | No (AI calls require network) | Yes |
A few narrow functions do go through Advisor Prep Hero infrastructure:
That is the complete list. Everything else stays on your machine.
Advisor Prep Hero uses the OS-native keychain to store API keys:
Keys are never written to application config files in plaintext, never logged, and never included in any diagnostic or crash report. If you delete the app, the key remains in your keychain under your control and must be removed from there if you want it gone.
We believe being direct about these gaps is more useful than burying them. The security story for Advisor Prep Hero is architectural: most of the threats that SOC 2 and a DPA guard against (unauthorized access to vendor servers, vendor breach, data shared with third parties) are substantially reduced by having no vendor servers in your data path to begin with. That's a meaningful substitute posture, not a compliance certification. They are different things, and we're not going to pretend otherwise.
No. Your documents are stored as files on your hard drive in the folder you chose. Advisor Prep Hero does not upload them to any server. The app reads them locally to display them in the editor. The only time any content leaves your machine is when you send a specific message to a cloud AI provider, and at that point it goes directly to the provider under your account, not through Advisor Prep Hero.
No. The API tier (which is what BYOK tools like Advisor Prep Hero use) does not train on inputs by default per Anthropic's commercial API terms. This is different from Claude.ai consumer accounts, which have different terms. Read Anthropic's Commercial Terms of Service for the current precise language.
Use the local model path. Configure Advisor Prep Hero to use Ollama with an open-weight model (Llama, Mistral, Phi, or similar) running on your hardware. With a local model configured, Advisor Prep Hero makes no outbound AI calls. Your prompts are processed entirely on your machine. This is the appropriate setup for content that must not reach any external server, period.
No. There is no cloud sync, no backup to Advisor Prep Hero's servers, and no account-linked storage. Your workspace exists only in the folder you chose on your machine. If your hard drive fails and you have no local backup, your workspace is gone. We recommend disk encryption (FileVault on macOS, BitLocker on Windows) and a local backup routine on top of Advisor Prep Hero.
The append-only audit log records: timestamp, AI model used, the list of files included as context, and the output produced. It does not capture the full prompt text by default (that is in the .aichat file). The log is per-workspace, stored on your machine, and can be exported as plain text. It is retained as long as your workspace folder exists.
Not a finalized, signed version yet. A draft template is in preparation under legal review. If you need a DPA for vendor approval, email [email protected]. Because Advisor Prep Hero does not process your data on its servers (it's stored on your machine), the traditional DPA framing that governs a cloud SaaS processor does not apply cleanly to our architecture. We'll work through the appropriate framing with counsel.
No. We do not hold a SOC 2 report today. If you need to understand our controls in detail, the source code is open at github.com/keepance/keepance. The short architectural answer: a SOC 2 audit focuses heavily on controls around a vendor's server-side data processing. Because we don't process your data server-side, most of the controls an auditor would test simply don't apply. We're evaluating whether to pursue an audit scoped to the parts that do (license server, update server, web demo proxy). That's a cost and timeline decision that isn't finalized yet.
Nothing changes. Your files are on your machine in plain Markdown and .aichat (JSON) format. They don't move. If Advisor Prep Hero disappears tomorrow, you still have your files, readable with any text editor. This is a deliberate design choice: your data should outlive the tool.
The Practice tier licenses up to five seats on the same machine or within one organization, but each instance runs independently as a desktop app. There is no centralized server, no shared database, no SSO, and no admin console today. Enterprise directory integration (SAML, LDAP) is not on the current roadmap. If that's a requirement, we aren't the right fit yet.
For security questions, vulnerability reports, or compliance review requests: [email protected]. For DPA or legal questions: [email protected].
If you are a CCO, IT reviewer, or malpractice carrier and need specific architectural documentation, I'm happy to answer questions directly. The goal is to give you an accurate picture, not a polished one.
I'm Jameson Daines, a senior product designer with a decade of experience designing products for sensitive healthcare and regulated-data environments, including work at Samsung and AstraZeneca. I built Advisor Prep Hero because the most useful AI tools are often the ones professionals cannot safely use with real client work. Advisor Prep Hero is my answer: a local-first AI workspace where confidential files stay in your control, answers are cited, and client context becomes something your team can actually use.
Local-first. BYOK. No Advisor Prep Hero servers in the data path. Try it free for 30 days.
Get Advisor Prep Hero