> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ai2fin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Intelligence on the desktop — how Fin thinks without the cloud seeing your books

> How categorising, chat and receipt reading work in the AI2Fin desktop app: what runs locally, what the stateless relay carries, and how to bring your own AI provider key so nothing ever passes through AI2Fin.

Most of what makes Fin useful runs **on your machine** and sends nothing. The
parts that need a model take one of two roads, and you choose which.

## What never leaves

Categorising by hand, categorising with the rules you have saved, reconciling,
reports, tax export, the asset register — all of it runs against the SQLite
database in your own folder. No request is made, so there is nothing to send.

<Card title="See it for yourself" icon="magnifying-glass" href="/guides/desktop-local-data">
  Turn on Airplane mode from the device chip and do a full day's work — import,
  categorise, run a report. The outbound record stays empty.
</Card>

## When you ask Fin to think

Asking Fin's intelligence to categorise a batch, answer a question, or read a
receipt is the one thing that needs a model. On the desktop that happens one of
two ways.

<CardGroup cols={2}>
  <Card title="Through Fin's relay" icon="cloud-arrow-up">
    The rows you asked about go to a **stateless relay**, are processed, and are
    **not kept** — no chat history, no cached copy, nothing written to any
    database. Fin records a count for your allowance, never the content.
  </Card>

  <Card title="Straight to your own provider" icon="key">
    Connect your own AWS Bedrock, Anthropic or OpenAI key and the request goes
    **from your machine to your provider directly.** Fin's servers are not in
    the path at all — a packet capture shows only your provider's address.
  </Card>
</CardGroup>

### The order Fin chooses

<Steps>
  <Step title="Your own key wins">
    If you have connected a provider key, every intelligence request uses it and
    goes straight to your provider.
  </Step>

  <Step title="Otherwise, a paid plan uses the relay">
    With no key connected, a Pro plan (or above) sends the request to the
    stateless relay. Free plans get a monthly chat allowance the same way the
    web app does; categorising, summaries and receipt reading are Pro features.
  </Step>

  <Step title="Otherwise, Fin says so">
    With no key and no paid plan, intelligent features are switched off and Fin
    tells you exactly how to turn them on — rather than failing silently.
  </Step>
</Steps>

## Bring your own key

This is the strongest privacy posture the product offers: **AI2Fin's cloud
never sees your content, because it is never in the path.**

<Steps>
  <Step title="Open the data panel">
    Click the device chip in the header to open **Where your data lives**.
  </Step>

  <Step title="Choose a provider and paste your key">
    Under **Where intelligence requests go**, pick AWS Bedrock, Anthropic or
    OpenAI and enter your credentials. For Bedrock you can paste temporary
    (STS) credentials, not only a long-lived key pair.
  </Step>

  <Step title="Save & test">
    The test sends one tiny request **through the same guarded path** real calls
    take. When it succeeds, it is the newest line in your outbound record —
    named as your provider, marked as going straight to them.
  </Step>
</Steps>

<Info>
  Your key is sealed on this machine (AES-256-GCM) and **never sent to AI2Fin**.
  It is not stored in the database — so it does not travel when you back up or
  copy your data folder.
</Info>

Bring-your-own is a paid-plan feature, and every BYO request still respects
**Airplane mode**: a key you connected is a connection you can pause, not an
exception to the boundary.

## What each request carries

<AccordionGroup>
  <Accordion title="Categorising through the relay">
    Only the rows involved — merchant, amount, date, the fields needed to
    classify. Processed and not retained. Your allowance counter goes up by a
    count; the content does not.
  </Accordion>

  <Accordion title="Reading a receipt">
    That one image, as a vision request. Processed and not retained. On a BYO
    key it goes straight to your provider.
  </Accordion>

  <Accordion title="Asking Fin a question (chat)">
    Your message and the context Fin assembled locally to answer it. Chat
    history lives in your local database, never on Fin's servers.
  </Accordion>

  <Accordion title="What Fin will NOT do">
    Send anything you did not ask for. Train a model on your data. Keep a copy
    of a relayed request. Bill an arbitrary model — the relay picks the model,
    so a modified client cannot run up a bill against Fin's account.
  </Accordion>
</AccordionGroup>

## Verify the claim

Everything above is checkable, and checking it is the intended reaction.

<Card title="Run a packet capture" icon="shield-check" href="https://ai2fin.com/local/verify">
  With Airplane mode on, nothing leaves. With a BYO key, the only destination is
  your own provider. With the relay, one destination per request, matching the
  line in Fin's own outbound record. The record and the capture agree — which is
  what makes the record worth trusting the rest of the time.
</Card>