Scope of this page.
General privacy principles, service purposes and Vault safeguards remain defined by the legal and Security pages.
Versioned supplement
This page documents behaviors specific to published Desk and Bridge versions.
Not a new policy
It does not replace the Privacy Policy or Data Protection notice.
Data minimization
Each application prepares what is needed locally before calling the Sealarca API.
Sealarca Desk: local processing before the API.
Desk 1.2.0 is a local static client. Import, extraction, search, dossier analysis from current profiles and storage stay in the browser. Model discovery, chat and explicit profile generation use Sealarca.
Persistent storage
IndexedDB uses schema v6 and retains folders, conversations, messages, settings, roles, documents, chunks, profiles, jobs, operations and traces. Originals, canonical Markdown and provenance stay local. The v5-to-v6 migration preserves existing records; historical profiles remain readable with unknown coverage where needed.
Local extraction
PDF, DOCX, XLSX, PPTX, ODT, ODS, CSV, TXT, Markdown, JSON, RTF, LOG and XML are processed in the browser with libraries distributed with Desk. The canonical result is Markdown accompanied by a provenance map.
Search and profiles
Full-text search, automatic selection, previews, original downloads, index.md export and analysis of current profiles run locally. Profile generation is explicit. The persistent queue automatically resumes only unsent preparations; an unknown network outcome requires an explicit retry.
Session key
The key is supplied to the local application, kept in sessionStorage for the tab session and used to authorize Sealarca calls. It is neither embedded in the public site nor retained in IndexedDB. Migration removes legacy IndexedDB keys; forgetting the key clears the session key.
Manual context
For each selected document, Desk adds the name, type and Markdown corresponding to the `sourceMap` ranges to the message. If no range is available, the full Markdown is used as a fallback. Manual mode can therefore transmit all or most of the selected document, not only short excerpts.
Automatic context
When a question is present, Desk ranks the folder documents locally and retains up to 5. It transmits up to 8 citable excerpts per document, centred on matches; without a question, it uses the first provenance ranges of the selected documents.
Document profile
A profile is explicitly generated via POST /v1/responses with store: false and the selected Sealarca model. Sent Markdown is bounded to 120,000 characters and 100 sources. Schema v3 profiles record complete, partial or unknown coverage; analyses based on partial or unknown coverage remain partial.
Network and offline use
Application calls target https://api.sealarca.ch/v1 for model discovery, chat and profiles. Libraries load locally without a runtime CDN. Search and analysis of existing profiles run locally; operations requiring a model need a connection.
Published limits
PDF, DOCX, XLSX, PPTX, ODT, ODS, CSV, TXT, Markdown, JSON, RTF, LOG and XML. 20 MiB per file; 500,000 extracted characters; 100 PDF pages; 100 PPTX slides. Limits can cause rejection or a flagged partial extraction. Five files per addition; 100 rows per spreadsheet sheet or CSV and up to 200 columns. Originals are retained and partial extractions are flagged. Office/ODF archives: up to 100 MiB expanded, 20 MiB per entry and 2,000 entries. No built-in OCR: check scanned pages and PDFs without a text layer. A profile uses up to 120,000 characters and 100 sources. Automatic context selects up to five documents and eight excerpts per document. Chat accepts 250,000 characters combined across instructions, history and selected context. Above this limit, sending is blocked without truncating context.
Local logs
Import, processing and network errors may be written to the browser console. The published code shows no Desk-specific telemetry or remote logging channel; conversation history nevertheless remains persisted locally.
Local operations and traces
Operations have persistent status, steps and notices. Dossier and chat traces retain document and source IDs, locators, counts and notices without copying document text. These traces stay in the browser and are separate from gateway logging.
Exports and recovery
The export/import mechanism uses format 6.0, including operations and traces. The index.md export describes a dossier and its references; it is not a restorable backup. The published distribution has no full backup button.
Repair and coverage
Legacy XLSX/ODT extractions can be explicitly repaired locally from their stored original. Identity and history are preserved, derivatives invalidated and the profile marked stale. No automatic AI regeneration is triggered; incomplete documents and missing current profiles are flagged.
IndexedDB is not presented as encrypted at-rest storage. Device and browser-profile security remain decisive.
Sealarca Bridge: local tool configuration.
Bridge temporarily adapts compatible applications so they use the routes and models authorized by your Sealarca key.
Key storage by system
Windows uses a DPAPI-encrypted file in `SEALARCA_BRIDGE_CONFIG_DIR` or `~/.sealarca-bridge`. macOS uses Keychain through `security`. Linux uses Secret Service through `secret-tool`.
No plaintext fallback
If secure storage is unavailable, Bridge refuses to retain the key. There is no permanent plaintext fallback. `SEALARCA_API_KEY` can provide the key temporarily to a process or session; `account login` records it in secure storage.
Claude Code
Bridge starts Claude Code with compatible Anthropic configuration injected into the child-process environment: base URL, authentication and selected model. Managed routing variables are filtered; no permanent configuration file is replaced.
Codex CLI
Bridge passes temporary `-c` options to Codex for the model, the `https://api.sealarca.ch/v1` URL, the Responses wire API and the `SEALARCA_API_KEY` variable. It does not replace `~/.codex/config.toml` or write the key there.
Claude Desktop
Bridge creates a managed local profile, retains authorized model identifiers and marks the affected Claude Desktop configurations as third-party mode. Host and port settings are kept in `~/.sealarca-bridge/config.json` (or the directory set by `SEALARCA_BRIDGE_CONFIG_DIR`). The profile contains a random 32-byte local token, distinct from the Sealarca access key. `claude-desktop restore` removes the Bridge profile, its metadata and this activation to return to official mode.
Targeted loopback proxy
The proxy applies only to the Claude Desktop integration. By default it listens on `http://127.0.0.1:15721`, requires the profile’s local token and accepts only `/v1/messages`, `/v1/messages/count_tokens` and `/v1/models`. It is not a general proxy for Claude Code or Codex; received bodies and local responses are limited to 16 MiB.
Dynamic models
Bridge retrieves authorized identifiers with `GET /v1/models`, then attempts `GET /v1/model/info` for safe metadata. This second response cannot add a model; if it is unavailable, models remain usable with unknown capabilities. No model name is hardcoded on the page.
Network communications
Bridge requests target the fixed `https://api.sealarca.ch/v1` URL. The Claude Desktop proxy forwards to the same origin after replacing local identifiers with the Sealarca key; requests to local clients remain on loopback.
Outputs and errors
Statuses, diagnostics and profiles display masked keys. Bridge relays the standard output of launched clients and may display operating errors or warnings; it does not control logs, histories, files or settings that Claude Code, Codex CLI, Claude Desktop or the operating system retain themselves.
Client applications and the device remain outside the Vault perimeter. Their own storage and logging rules must be reviewed.
What differs from general Sealarca operation.
Sealarca does not log prompts or responses processed in Vault. Local applications may nevertheless retain data on the device to provide their functions.
Before the call
Desk keeps documents, profiles and traces locally. Dossier analyses aggregate current profiles without sending text; explicit profile generation sends Markdown to Sealarca and chat sends selected context. Local traces retain references, counts and notices without copying document text.
Data sent
The call contains only content selected by the user or required for the application context.
Local responsibility
Encryption until Vault does not cover the device, browser or client applications.
Versions and updates.
Review this page whenever a Desk or Bridge version changes local storage, transmitted content, logging, keys or Sealarca integration.
- Sealarca Desk 1.2.0
- Sealarca Bridge 1.0.0
- 2026-09-30