Why Local Analysis Matters in Email Clients

Every time a webmail service scans your attachments "for security," your documents travel to external servers to be analyzed. Local analysis offers the same protection without compromising your privacy.

What does local analysis mean?

Local analysis means all security checks are performed directly on your computer, without sending data to external services. The email client inspects messages, links, and attachments using its own analysis engine, without relying on third-party APIs or cloud services.

This contrasts with the approach of many webmail services and some desktop clients that send attachments to external servers for analysis.

The problem with remote inspection

When a service analyzes your files in the cloud:

1. Your documents are accessible by third parties: invoices, contracts, personal and corporate information pass through servers you don't control.
2. You depend on internet connectivity: no connection means no security analysis.
3. Latency: sending files to a server, waiting for analysis, and receiving the result takes time, especially with large attachments.
4. Opaque retention policies: how long do your files remain on those servers? Who has access? You generally don't know.
5. Regulatory compliance: in many contexts (legal, medical, governmental), sending documents to external services may violate data protection regulations.

What can be analyzed locally

You don't need an external service to detect most common email threats:

Attachments

• Dangerous extensions: detecting .exe, .bat, .scr, .ps1, and other executables is a trivial check that doesn't require external analysis.
• Double extensions: identifying file.pdf.exe as a disguised executable is a text comparison.
• Compressed file contents: listing the contents of a ZIP or RAR and checking each entry is done with standard local libraries.
• Macros in Office documents: searching for vbaProject.bin inside an OOXML file or inspecting directories in ODF files is direct file structure reading.

Links

• Text/destination mismatch: comparing the visible domain with the link's actual domain is text processing.
• Homograph domains: detecting punycode and Unicode script mixing is string analysis.
• URL shorteners: checking against a list of known shortening domains is a simple lookup.
• IP-based URLs: detecting IP addresses instead of domains is a regular expression.

Message metadata

• Sender mismatch: comparing the From address with Reply-To and with addresses in the display name.

Advantages of local analysis

Aspect	Local analysis	Remote analysis
Privacy	Your files never leave your machine	Your files are sent to third parties
Speed	Immediate	Depends on network and server
Availability	Works offline	Requires internet connection
Compliance	Compatible with data regulations	May violate privacy policies
Cost	No additional charges	May require subscription

Honest limitations

Local analysis has limitations that are important to acknowledge:

• It doesn't replace antivirus: local analysis in an email client detects known deception patterns (social engineering, file disguises, suspicious links). It doesn't perform malware analysis with updated signatures like a dedicated antivirus would.
• It can't analyze encrypted content: a password-protected ZIP file cannot be inspected without the key.
• Legacy binary formats: some older formats (.doc, .xls, .ppt) can't be fully inspected without specialized libraries.

The ideal strategy is a combination: local analysis as a fast and private first line, complemented by an up-to-date antivirus on the operating system.

How BrisaMail implements it

BrisaMail was designed with local analysis as a core principle:

• The entire analysis engine runs on your machine: no files or data are sent to external servers. All checks run within the application process.
• Automatic analysis on viewing: when you open a message, BrisaMail analyzes the content without you having to do anything. No need to click "scan."
• 14 types of checks: from dangerous extensions to homograph attacks, covering the most common email threats.
• Three severity levels: info, warning, and danger, so you can prioritize your attention.
• Clear interface: a color-coded banner (red, amber, blue) displays alerts in an expandable format, with detailed context for each warning.
• Informed user decisions: dangerous attachments are blocked by default, but the user can consciously unblock them after reviewing the warnings.

Conclusion

Local analysis isn't a technological limitation — it's a design decision that prioritizes your privacy without sacrificing protection. In a world where more and more services want access to your data "for your security," an email client that analyzes everything on your machine offers the best of both worlds.