> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Draftable Clean handles your data

> Where your documents go when the Draftable Clean desktop app and Outlook add-in clean them, which network connections they make and why, what usage data contains, and what is stored on your computer.

This page explains what happens to your documents and other information when you use the Draftable Clean desktop app and the Outlook add-in. It is written for security reviews as well as for curious users.

## The short answer

* The Draftable Clean desktop app scans and cleans documents **on your computer**. Your documents are not sent to Draftable.
* The Outlook add-in hands attachments to the desktop app on the same computer, which cleans them, and puts the cleaned copy back on your email.
* Draftable Clean does use the network: to check your license, to download updates, for optional usage statistics and error reports, and for the Microsoft and document management services you choose to use. These connections do not upload your documents to Draftable. Files you choose to save to a document management system or send by email travel to that destination.

## Where your documents go

### In the desktop app

When you add a file, by browsing, dragging it in, or opening it from iManage, NetDocuments or SharePoint, Draftable Clean reads it on your computer. Scanning, cleaning, converting to PDF and bundling all happen locally. The cleaned copy goes only where you send it: a folder you save to, an Outlook email you create with **Email**, or your document management system.

Files you open from or save to a document management system travel between your computer and that system, as they would with any other desktop app. They do not pass through Draftable.

### In the Outlook add-in

When you attach a file to an email, the add-in reads the attachment through Outlook and sends it to the Draftable Clean desktop app on the **same computer** over `localhost`, a connection that does not leave the computer. The desktop app cleans the file and the add-in replaces the attachment with the cleaned copy.

So that you can re-clean an attachment with a different profile, the desktop app caches original attachment bytes **in memory**. An entry stops being reusable after 30 minutes without access. Expired entries are removed during subsequent cache access or cleanup, when explicitly released, or when the application exits. Capacity limits can remove entries earlier. This is not a guarantee that the bytes are erased from memory after 30 minutes. While the Draftable Clean pane is open in Outlook, the add-in may also keep the originals of smaller attachments in memory, and discards them when the pane closes.

### The send-time check

If your organization has approved Draftable's app, **Draftable Clean**, in Microsoft Entra ID, the add-in runs a **send-time check** in New Outlook and Outlook on the web. When you press **Send**, it reads the email you are sending from your own mail server through Microsoft Graph and confirms the attachments are the cleaned copies.

The check uses the read-only `Mail.Read` permission. With the same permission, the add-in can also read attachments through Microsoft Graph, which is faster than reading them through Outlook, and look up your organization's message size limit, so that it can plan how to swap in cleaned attachments without going over that limit. If Microsoft Graph is not available, the add-in reads attachments through Outlook instead. It does not write to your mailbox through Microsoft Graph, and the add-in never asks you to sign in for it. The request goes from Outlook on your computer to Microsoft; there is no Draftable server involved. See [Approving Draftable Clean in Microsoft Entra](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md).

### Files protected by Microsoft Purview

If your administrator turns on support for Purview protected files, Draftable Clean signs you in to Microsoft 365 and uses Microsoft's protection service to decrypt the file **on your computer**. The file is not sent to Draftable. See [Cleaning files protected by Microsoft Purview](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Cleaning-files-protected-by-Microsoft-Purview.md).

## Network connections

| Connection | Why | Can it be turned off? |
| - | - | - |
| `draftable.com` (HTTPS, 443) | Activating and checking your license | No. Needed for Draftable Clean to run |
| `dl.draftable.com` (HTTPS, 443) | Automatic updates for the per-user installer, installer downloads, and loading the Outlook add-in | Updates do not apply to the machine-wide MSI, which IT updates |
| `localhost` (HTTP, port 5044) | The Outlook add-in talking to the desktop app on the same computer | Needed for the add-in. The Outlook add-in always connects on port 5044, so if you use the add-in, leave the listener port at 5044 |
| Microsoft Graph and Microsoft sign-in | The add-in's send-time check, reading attachments, and finding your organization's message size limit; the SharePoint integration; and Purview protected files | Only used if you approve or turn on those features |
| Your iManage or NetDocuments servers | Opening and saving files in your document management system | Only used if you use those integrations |
| `draftable.com` (HTTPS, 443) | Error reports | Yes |
| Microsoft Azure | Usage statistics | Yes |

> [!WARNING]
>
> The Outlook add-in always connects to Draftable Clean on port **5044**, whatever the **Configure HTTP listener port** policy says. If your organization uses the Outlook add-in, leave the listener port at 5044. Changing it stops the add-in from reaching the desktop application.

For the full allowlist, see [Network Requirements](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Network-Requirements.md).

## Usage statistics

Usage statistics (telemetry) help Draftable understand how the product is used. They are **on by default**, and you are asked to acknowledge them on first launch. You can turn them off in **Settings > General > Privacy**, and administrators can turn them off for everyone with the **Configure submission of usage statistics** policy.

Usage statistics record **actions and outcomes**, for example that a scan or clean finished, whether it succeeded, how long it took, the file extension (such as `.docx`), and how many files were selected. Each event also carries:

* the Draftable Clean version, release channel and edition, and whether it is a trial
* the Windows version and whether it is 64-bit
* whether Draftable Clean is running on a virtual machine
* a random, anonymous identifier stored in your Windows profile, and a random session identifier
* your organization identifier, if your administrator has set one with the **Configure an organization identifier** policy

They do **not** include document content or file names. When a Purview protected file is cleaned, usage statistics record only how many unprotected copies were saved and to what kind of destination.

> [!TIP]
>
> Draftable Clean writes every usage event to a local file, `telemetry.log`, whether or not sending is turned on. A security reviewer can inspect the event names, properties and metrics in this file. Transmitted events also carry the application, device and identifier context described above. See [Logs](#logs) for where it is.

## Error reports

If Draftable Clean hits an unexpected error, it can send an error report so Draftable can fix the problem. An error report is an exception report: it describes the error and where in the application it happened. Error messages sometimes include the path of a file involved, so a report can include file and folder names. Error reports are **on by default**. Turn them off in **Settings > General > Privacy**, or for everyone with the **Configure submission of error reports** policy. See [Configuring preferences with Group Policy](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Group-Policy-Draftable-Clean.md).

## What is stored on your computer

| What | Where | Notes |
| - | - | - |
| The application | Per-user installer: `%LocalAppData%\DraftableClean`. Machine-wide MSI: `C:\Program Files (x86)\Draftable\Draftable Clean` | |
| Your settings, including domain rules | Windows registry, under `HKEY_CURRENT_USER\Software\Draftable\Clean` | Settings set by your administrator are under `Software\Policies\Draftable\Clean` in `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER` |
| Working copies of files being cleaned | A folder under `%TEMP%\Draftable` in your Windows profile | Deleted when Draftable Clean closes. If it does not close normally, for example after a power cut, copies can be left behind; delete the folders under `%TEMP%\Draftable` while Draftable Clean is not running |
| License activation | `license.json` in `%LocalAppData%\DraftableClean` | Kept when you update or upgrade Draftable Clean |
| Embedded browser data | A folder under `%TEMP%\Draftable.Sweeper` in your Windows profile | Used by the browser built into Draftable Clean, including sign-ins to your document management system |
| Logs | `%LocalAppData%\DraftableClean\draftable-clean` | See below |
| Http service log (machine-wide MSI only) | `%ProgramData%\DraftableClean\service.log` | Written by the Draftable Clean Http service |

### Logs

Draftable Clean keeps three log files: `app.log`, `telemetry.log` and `viewer.log`. Each file is capped at 10 MB, with up to three older copies kept, so the logs do not grow without limit.

Logs record what the application did, to help support diagnose problems. Logs can contain personal information and text extracted from documents, including text detected beneath improper PDF redactions. They can include the names and full folder paths of files you clean (which often show your Windows user name), the names of email attachments, which the Outlook add-in passes to the desktop app's log, the email addresses of recipients when the Outlook add-in chooses a cleaning profile, and the hidden information Draftable Clean found or removed, such as author and reviewer names, document titles and other property values. Review the logs, and remove anything sensitive, before you share them. Logs stay on your computer unless you choose to share them, for example with **Settings > Troubleshooting > Email logs**. See [Troubleshooting: Diagnostic logs and support](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Diagnostic-Logs-and-Support.md).

## Related articles

* [Network Requirements](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Network-Requirements.md)
* [Approving Draftable Clean in Microsoft Entra](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md)
* [Configuring preferences with Group Policy](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Group-Policy-Draftable-Clean.md)
* [Frequently Asked Questions](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Frequently-Asked-Questions.md)

For security questionnaires or further questions, contact [support@draftable.com](mailto:support@draftable.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.