#1379 Use of NAPS2 in a charity setting processing sensitive information

[Joshua Clark]

Hi there,

I work for a charity, we are currently looking at making use of NAPS2 in one of our teams but we process lots of sensitive information and so before we can proceed my IT team has asked for answers to these questions, is it possible to have them please?:

· The legal person or entity responsible for the project and the appropriate security/privacy contact.
· Whether NAPS2 sends any telemetry, crash reports, update checks, document metadata or usage information off-device by default.
· Whether scanned images, OCR text, logs or filenames ever leave the endpoint during standard use.
· The precise storage and protection of Gmail and Outlook tokens, including operating-system credential-store use.
· Whether any support process may require users to submit logs containing personal data.
· The supported disclosure route for security vulnerabilities and expected remediation approach.
· Whether signed installers, SBOMs and supported-version/security-maintenance periods are available.
· Whether any current or planned feature uses customer content to train or improve machine-learning models.

Thanks,
Joshua Clark