By default, pulpSuite works on your device: your documents stay in your browser or in your files on disk. Only the services you choose to use, or that your administrator has set up, send data elsewhere, and they say so where you turn them on.
What stays on your device
- Your files: pulpSuite reads and writes them on your disk when you ask it to (see Work folder).
- Browser storage: backup copies of open documents, pulpNote notes (and its encrypted vault), mail imported into pulpInbox, pulpHome papers and budget, each app's settings.
- On-device AI features: cut-outs, local transcription, reading text in documents… They are downloaded once from the pulpSuite server, with your agreement, then work on your machine: your files are sent nowhere (see AI models).
- pulpAssist's AI on this device (“Try an AI on this device”): it runs on your computer. Nothing leaves it, no consent is asked for and there is no limit.
- Your language choice and your acceptance of the terms of use are kept in the browser, not on a server (if you create a pulpSuite account, the acceptance date is also recorded with the account, see below).
- File sharing through a synchronized folder (pulpClient, pulpForge, pulpProduct, pulpArchive, pulpHome, pulpBuild, pulpSheet, pulpPlan and pulpSlide) doesn't go through any pulpSuite server: the file travels through the folder you chose and the service that syncs it (see Sharing a file and Where your data lives).
The pulpSuite server sends you the app, its updates, AI features, dictionaries and fonts. These downloads contain nothing from your documents. The pulpSuite servers are in Paris (see Where the servers are).
What may leave your device
These features are optional. Nothing is sent until you use them.
| Feature | What is sent | To whom |
|---|---|---|
| Mail (pulpInbox) | Your messages and your sign-in details | Your mail providers, through the pulpSuite server. On online pulpSuite, with the account's End-to-end encryption (beta) option, they go end-to-end encrypted through this server, which can't read them; without it (the default during the trial), it sees them for the length of the session, without storing them |
| Connected calendars (pulpInbox) | Your appointments and your sign-in details | Your calendar providers, through your installation's mail bridge, which reads them for you |
| Online assistant (pulpAssist) | Your question, the conversation history, a snapshot of what is open (if you leave it attached), attached images and the content the assistant reads to answer | On online pulpSuite: an AI provider from the regions you accepted (during the no-account trial, Mistral AI only), through the pulpSuite gateway in Paris, which doesn't store the content (see The online assistant). On another installation: the service chosen by its administrator. The AI on this device sends nothing |
| Dictation and transcripts using the browser's speech recognition (pulpDoc, pulpCrew) | The sound of your voice | The company that makes your browser |
| pulpDoc grammar checker (off by default) | The text being checked | The server whose address appears in the Proofing panel |
| Meetings (pulpCrew) | Your video, your voice, your messages and the files you share, encrypted | The other participants, directly when possible, otherwise through a relay that can't read them; a connection service helps you find each other and sees none of the content |
| Direct exchange between devices (file sharing) | The changes to the shared file, encrypted | The other device, directly; a connection service helps you find each other and sees none of the content |
| Text-guided fill (pulpPhoto) | The image, the area to recreate and your description | The image generation server you installed yourself |
| Local relays (pulpLab, pulp3D) | Your program, or the file to convert | A small program running on your own machine |
| pulpSuite account (optional) | Your email address, then the list of your signed-in devices, your consents and your plan | The pulpSuite server (see pulpSuite account) |
A few details:
- pulpAssist never sends the pulpNote credential vault or your passwords. The pulpSuite “About” page shows the current setup (online service, AI installed on your network, demo mode or no provider) and the list of active AI providers.
- pulpInbox: a mail account password is only used to open the session; it is never stored. On online pulpSuite, your browser encrypts the connection all the way to your mail server: the pulpSuite server sees neither your password, nor your messages, nor your recipients, only the name of the server reached, the amount of data and the length of the connection. It reads them only if you agree to Go through the pulpSuite server for an incompatible mail server, and for calendars. With Google or Microsoft sign-in, no password is stored in pulpSuite; the server keeps the authorization, encrypted. See Mail and account sign-in.
- “Dictation on this device” in pulpDoc sends nothing: it uses a feature downloaded once.
- pulpHome keeps everything on the device: papers, text it has read, budget. If it scans your recent pulpInbox messages, that is with your agreement and on the device.
The online assistant (pulpAssist)
On online pulpSuite (www.pulpsuite.com), pulpAssist can answer in two ways:
- with the AI on this device: nothing leaves it, no consent is asked for, no limit. It is offered everywhere as an alternative;
- with an online AI service: only under the conditions described below.
Three access levels
| Level | Online AI services used | Limits |
|---|---|---|
| No account (trial) | Mistral AI (France) only, after ticking a box just before sending | 5 exchanges per day per device, and 10 per day for the same IP address. Fast and Balanced levels (the Precise level falls back to Balanced) |
| Free account | Providers from the regions you ticked | 5 exchanges per 5-minute period; 200 exchanges per day, a daily answer volume and a separate limit for the Precise level |
| Paid account (not on sale yet) | Providers from the regions you ticked, with priority when the service is busy | No rate limit; only a very high safety cap and the service's overall cap |
- An exchange is one round trip with the AI service. A question that has the assistant read and then edit a document can count as several.
- Daily counters reset every night, at midnight Coordinated Universal Time (1 or 2 a.m. in Paris, depending on the season).
- When the limit is reached, the assistant shows the time of the next possible question and offers you the AI on this device.
- No online payment is in place today: the paid plan can't be purchased yet.
What is sent
- Your question and the history of the current conversation.
- A snapshot of what is open (app, document, selection, open message…), if you leave it attached.
- Attached images.
- The content the assistant reads in your apps while answering, within the scope you chose: Open app or Whole suite.
Never sent: the pulpNote credential vault and your passwords.
Your requests go through the pulpSuite gateway, in Paris. It relays them to the AI provider without storing any of their content. Its log records one line per exchange: your account in an unreadable form (a fingerprint), or “trial” without an account, the level, the provider, the result, the duration and the volume. It never contains the content, nor your email address.
The AI provider then processes the data under its own terms, which you can read on its website.
Providers by region
You choose the regions. The pulpSuite gateway enforces this choice itself, not just the screen: it never falls back to a region you haven't accepted. If no provider from your regions is available, the assistant tells you and offers to add a region or to use the AI on this device.
| Region | Providers | Country | Note |
|---|---|---|---|
| Europe | Mistral AI | France | Within the European Union |
| United States | Anthropic, OpenAI, Google (Gemini), xAI | United States | Transfer outside the European Union |
| United States, plus the region of the model's publisher | OpenRouter (relay) | United States | Always counted as United States. If the model comes from a publisher in another region (for example a Chinese publisher, or Mistral AI), consent for that region is also required |
| Asia | DeepSeek, Moonshot AI (Kimi), Zhipu (GLM) | China | Transfer outside the European Union; see the warning below. Zhipu (GLM) is only reached through a relay (Mammouth or OpenRouter) |
| Region of the model's publisher | Mammouth (relay) | France | A French company that relays to various publishers. Each model counts in the region of its actual publisher: Europe for a Mistral AI model, otherwise the publisher's region; United States, to be safe, if the publisher is unknown |
The provider actually used depends on how the service is set up and on availability. The “About” page lists the active providers.
Transfer outside the European Union. With the United States and Asia regions, your data is sent outside the European Union. The laws of these countries may allow their authorities to access data processed by these providers.
Your consents
You give and withdraw them in My account, under Privacy and AI (see pulpSuite account).
| Consent | What you accept |
|---|---|
| Europe | The content of your emails and documents that you send to the assistant may be sent to a European AI service: Mistral AI (France) |
| United States | The same content may be sent to American services: Anthropic, OpenAI, Google (Gemini), OpenRouter, xAI. This is a transfer outside the European Union |
| Asia | The same content may be sent to Asian services, all in China: DeepSeek, Moonshot AI (Kimi), Zhipu (GLM). Weaker protection, possible access by local authorities |
| Online backup of emails | Coming soon: only your consent is recorded (see below) |
| Online backup of documents | Coming soon: only your consent is recorded |
| Data not guaranteed | “pulpSuite does not guarantee against data loss; keep your own backups.” Required to turn on online backup |
- Nothing is ticked when the account is created. The first time you use online AI, a sheet offers you the regions. Europe is suggested there, but not ticked for you.
- Each consent is dated and tied to the version of the text you accepted.
- You can withdraw a consent at any time. Withdrawal takes effect straight away in the browser; an authorization already issued to the gateway expires within 15 minutes at most.
- Every change is added to a history that is never altered. It is kept as long as the account exists and deleted with it.
The no-account trial
- Just before sending, a box reads: “Your question and the attached documents will be sent to Mistral AI (France).” If the box isn't ticked, nothing is sent.
- To count trial exchanges, the browser keeps a randomly drawn device identifier. It contains no personal data.
- The gateway keeps the number of exchanges per device identifier and per IP address in memory only, never on disk, until the nightly reset.
- In the gateway log, these exchanges are recorded as “trial”, without an account.
Online backup (coming soon)
Online backup of emails and documents doesn't exist yet. You can already give your consent: it is only recorded. Nothing is sent or backed up today. To turn it on, you will also have to accept that data is not guaranteed. Both consents are unticked by default.
Where the servers are
All pulpSuite servers are currently in Paris (France), on a virtual private server from the hosting company Hostinger. The services you connect (mail, calendar, online AI services) have their own servers; for AI, their countries are given above.
Your data is not guaranteed
Your documents are on your devices. Save them to disk and keep copies on another medium (see Open documents and backup copies).
pulpSuite account (optional)
Without an account, nothing above changes. If you create a free pulpSuite account, which mail on the pulpSuite server and the online assistant beyond the no-account trial ask for, the pulpSuite server keeps:
| Data | Why | How long |
|---|---|---|
| Your email address, the account creation date, the language of the messages | Sending you sign-in codes and recognising you | As long as the account exists; it is deleted after 3 years without any sign-in |
| The version and date of the terms of use you accepted | Keeping a record of your acceptance | Same as the account |
| Your consents (AI regions, online backup, data not guaranteed), with their date, the version of the text accepted and the history of their changes | Respecting your choices and keeping a record of what you authorized | Same as the account; deleted with it |
| Your plan (free or paid) and its end date | Applying the online assistant's limits | Same as the account |
| Your signed-in devices: browser and system (for example “Firefox · Windows”), sign-in date and last use | Showing them to you and letting you sign them out | Until you sign out, or 30 days without use; erased the next day |
| Sign-in codes, in an unreadable form | Checking the code you enter | Usable for 10 minutes, erased the next day at the latest |
| A security log: date, IP address, account and type of event (code requested, sign-in, sign-out…) | Spotting and slowing down abuse | 6 months |
- The account holds no password, no documents and no messages.
- Codes are sent by the pulpSuite server itself, without any outside sending service.
- The log never contains the code, the sign-in link or the content of a message. An address without an account only appears masked (“a***@example.com”).
- When you use mail on the pulpSuite server, the mail bridge receives your account identifier and your email address, through a pass that is valid for 15 minutes. Its log (30 days) records, for each connection to your mail server: the date, IP address, account, name of the mail server, amount of data and duration; never any content.
- When you use the online assistant, its gateway receives an authorization valid for 15 minutes at most, which tells it your accepted regions and your plan.
- In the browser, the account only adds a sign-in marker that is strictly necessary and unreadable by pages, plus the initial of your address for the home screen button.
- Delete my account, in My account, immediately erases the account, its devices, its codes, your consents and their history. Log lines about it then only carry an anonymous identifier and disappear after 6 months.
Analytics
To date, neither the suite nor this website loads any analytics or advertising tool.
Erase your data
- One document: close it; its backup copy is deleted, including the one in
.pulpdesk-secours. - Downloaded AI features: the Remove button in the AI models on this device panel.
- Everything pulpSuite keeps in the browser (including the device identifier of the no-account trial): uninstall pulpSuite and choose to clear its data, or clear the site's data in your browser settings. Files on your disk are not touched.
- A mail account: Remove this account in pulpInbox. Your messages stay on your provider's server.
- pulpAssist conversations: Delete this conversation in the assistant's History.
- Your consents: untick them in My account, under Privacy and AI. Their history is deleted with the account.
- The pulpSuite account: Delete my account in My account (see pulpSuite account).
Frequently asked questions
Do I need an account to use pulpSuite?
No. Every app works without an account, and so does the AI on this device. A free pulpSuite account is required for mail on the pulpSuite server and for the online assistant beyond the no-account trial (5 exchanges per day). The services you connect (mail, calendar) also ask you to sign in with their provider.
Are my documents sent to a server to be saved?
No. They are saved on your disk or kept in your browser. Online backup doesn't exist yet. pulpSuite does not guarantee against data loss: make your own backups (see Open documents and backup copies).
Who chooses the AI service behind pulpAssist?
You do, by region. In My account, under Privacy and AI, you tick the regions you accept (Europe, United States, Asia). The assistant only uses providers from those regions, among the ones the pulpSuite publisher has set up. Without an account, the trial only uses Mistral AI (France). On another pulpSuite installation, its administrator chooses the service. Without your consent, the online assistant sends nothing.
Can I use the assistant without sending anything?
Yes. The AI on this device runs on your computer: nothing leaves it, no consent to give and no limit.