About Quorvyn

Why local

For material of that kind, the usual route goes through the cloud. You upload it, have it analysed there and get a result back. That route asks for trust at exactly the point where the least trust is available, and it creates a copy of every job in a place you do not control.

The Quorvyn applications turn that around. The analysis models sit on the device alongside the application and run there. There is no upload path anyone could switch on by accident, because none exists. That is more work to build than the cloud route and it rules some features out. We pay that price deliberately.

A tool, not a service

A Quorvyn application is a tool that sits on your machine rather than a login you rent. It starts and works without signing in. A subscription will later unlock the expensive features, but what works without one stays free for good and is not a trial that runs out.

The difference matters on the day a subscription ends. Whatever you have created until then stays readable and editable, because it lives on your device and not in an account that can be switched off.

Where that does not hold

One application falls outside this pattern, and does so by design. Quorvyn News continuously analyses public news sources and compares them against a historical body of cases. That cannot sensibly be put on a work machine, so it runs on a server. Only the watchlists stay local there.

We name this exception here and on its product page so that nobody discovers it only later.

What this does not mean

Local processing is not a free pass. It replaces neither proper encryption on the device nor traceable updates, and it does not turn an indication into a settled finding. Where an application only offers pointers, that is stated on its product page and not in the small print.

The rules we build by

As a sole proprietorship, Quorvyn sits well below the thresholds at which NIS2 covers a company itself. We still work to what customers bound by NIS2 are entitled to ask of their suppliers. First among that is a clear, public route for reporting vulnerabilities, described on the security page, rather than an address someone has to go looking for. The Cyber Resilience Act requires such a route from every manufacturer anyway.

We classified Quorvyn Docyra, Quorvyn Train and Quorvyn Imaging ourselves before any of them is released. Under the Cyber Resilience Act they are products with digital elements that count neither as important nor as critical, so we assess their conformity ourselves, without a notified body. Where a trained model is involved, it is not a high-risk system under the EU AI Act and is subject to no specific transparency obligations. If the scope of a product changes, we review the classification again.

The GDPR applies independently to every enquiry that reaches us. Because your content stays local, many of its questions never arise in the first place. For the files you open there is no processor and no transfer to a third country. And because the analysis runs on your device and never reaches us, we make no automated decision about a person from it. Where an application does involve a service, such as the optional sign-in in Docyra, its product page says so.

Where things stand

None of the applications is available yet. Two are in development, two are concepts, and every product page says which of the two applies rather than implying an availability that does not exist.

Quorvyn elsewhere