On-device by default

What runs locally

Editing, redaction, signing, password protection, OCR, search indexing, and Apple Intelligence chat all run as local computation on your iPhone, iPad, or Mac. None of them send your document anywhere to do their job, because there's no Colophon server for any of it to call out to.

Why that matters

A document you never explicitly share never leaves your device in any form: not as a full upload, not as an anonymized fragment, not as a training sample. Two narrow paths can touch the network, and neither sends the document itself: iCloud sharing, which you ask for by name (see iCloud and your data), and — only when you digitally sign — an optional trusted-timestamp request that sends a hash of the signature to a timestamping authority (see Digital signatures).