Models and setup

Qvault works out of the box with pattern and heuristic detection. Two optional features need model files on your computer: AI detection (Layer 3) and OCR for scanned documents. This page explains where the files come from and how to install them.

What needs a model

All models are managed in Settings → AI Detection (the Model Manager). Models are stored in Qvault’s app data folder, are checked against a pinned SHA-256 before first use in each session, and can be deleted at any time. AI and OCR are available in the desktop app only.

AI detection models (Layer 3)

In the Model Manager, click Download next to a model. Qvault shows the size and the source host before anything is transferred. The download comes straight from Hugging Face over HTTPS (never peer-to-peer), shows real progress, can be cancelled, and is verified against the size and SHA-256 below before it is moved into place.

Privacy Filter (default detector)

OpenAI Privacy Filter is the recommended detector. It labels each page in one pass, in about 0.2 seconds on a CPU, and needs about 2 GB of memory. It is four files (about 1.65 GB in total) from the pinned revision of openai/privacy-filter, Apache-2.0. The Model Manager downloads all four; to import, choose Import folder… and pick a folder that contains them (the Hugging Face layout with an onnx/ subfolder also works), or import the files one at a time. Qvault keeps a partial set until the last file arrives.

SHA-256 (model_quantized.onnx): a325fb5341567a73c94e91ec5e49060d38d9b16111f518ad34773039a0c9c098
SHA-256 (model_quantized.onnx_data): 50f4c8c7f3c27fbc1fe16d4f74f6f7c3b74ba8f18a262e8b6911854c64c33a6d
SHA-256 (tokenizer.json): 0614fe83cadab421296e664e1f48f4261fa8fef6e03e63bb75c20f38e37d07d3
SHA-256 (viterbi_calibration.json): bbc8611ef08a55ed72d64856cbbbb9a91db8dfa881f0a92e2afbad6e4bbc775a

Privacy Filter does not look for company names, amounts or case numbers; Layers 1–2 still cover those, and the optional thorough pass below adds a language model.

Language models (optional thorough pass)

A language model can run after Privacy Filter (Also run the language model), which finds the most but is much slower (about 6 seconds per page with a GPU), or instead of it.

SHA-256 (qwen3-1.7b-q8_0.gguf): 061b54daade076b5d3362dac252678d17da8c68f07560be70818cace6590cb1a
SHA-256 (qwen3-0.6b-q8_0.gguf): 9465e63a22add5354d9bb4b99e90117043c7124007664907259bd16d043bb031
SHA-256 (qwen3-4b-q4_k_m.gguf): 7485fe6f11af29433bc51cab58009521f205840f5b4ae3a32fa7f92e8534fdf5
SHA-256 (qwen3-8b-q4_k_m.gguf): d98cdcbd03e17ce47681435b5150e34c1417f50b5c0019dd560e4882c5745785
SHA-256 (qwen2.5-0.5b-instruct-q4_k_m.gguf): 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db
SHA-256 (qwen2.5-1.5b-instruct-q4_k_m.gguf): 6a1a2eb6d15622bf3c96857206351ba97e1af16c30d7a74ee38970e434e9407e

Then turn on Use AI detection (Layer 3) when scanning. AI findings are labelled with the detector that found them and added with a confidence that depends on the category (for example 80% for names, down to 50% for addresses and case numbers) and always wait for your review. If Privacy Filter cannot run, the scan uses the language model if one is installed. If the AI engine is unavailable or a chunk fails, the scan still completes with Layers 1–2 and the viewer tells you what was skipped.

Entity grouping model (optional)

Qvault groups spellings of the same name, company or number with rules that need no model. An optional embedding model adds extra proposals based on meaning; it never merges anything by itself. On our small test set it did not improve the result, so you can skip it.

SHA-256: 06e7a7e594a26985523c18383aba4aad39fe6e14f08ffc6ab5b554e1ccdc3cff

OCR models: download and import

The OCR models are not downloaded by the app. Download the two files below yourself, check them, and import them. You only need to do this once per computer.

SHA-256 (craft_mlt_25k.gguf): 74501993caf4581ce09b280f49a1b3d249c0f5a78496e047718b398457a875aa
SHA-256 (latin_g2.gguf): dd1c7a436e9175904e63683e939635892f45c8c6377d5e14e87cf8b175e10768

1. Download both files into one folder, for example Downloads/qvault-ocr. Use the links in the table above. Keep the file names unchanged.
2. Verify the checksums (see below). Each printed hash must match the table exactly.
3. Open Qvault → Settings → AI Detection and find OCR models.
4. Click Import from file… and choose craft_mlt_25k.gguf. Repeat for latin_g2.gguf. Qvault recognises each file by its SHA-256 and copies it into its model folder.
5. Optional: click Test AI engine to run OCR on a built-in sample image. You can then delete the downloaded copies.

Verifying checksums

Qvault checks the hash itself on import, so a damaged or altered file is rejected either way. Checking it yourself first is good practice, and it is how you confirm that a file copied onto removable media is intact.

macOS and Linux

cd ~/Downloads/qvault-ocr
shasum -a 256 craft_mlt_25k.gguf latin_g2.gguf
# Linux also has: sha256sum craft_mlt_25k.gguf latin_g2.gguf

Windows (Command Prompt)

cd %USERPROFILE%\Downloads\qvault-ocr
certutil -hashfile craft_mlt_25k.gguf SHA256
certutil -hashfile latin_g2.gguf SHA256

In PowerShell you can use Get-FileHash .\craft_mlt_25k.gguf -Algorithm SHA256. Windows prints the hash in upper case; compare it ignoring case.

Expected output:

74501993caf4581ce09b280f49a1b3d249c0f5a78496e047718b398457a875aa  craft_mlt_25k.gguf
dd1c7a436e9175904e63683e939635892f45c8c6377d5e14e87cf8b175e10768  latin_g2.gguf

Air-gapped machines

Many firms keep document review machines off the network. Qvault supports this fully:

1. On a connected computer, download the Qvault installer from GitHub Releases, the two OCR files above and, if you want Layer 3, the four Privacy Filter files and optionally a Qwen model file from the links below.
2. Verify every checksum on the connected computer.
3. Copy the files to removable media and onto the air-gapped machine. Verify the checksums again there.
4. Install Qvault and import each model with Import from file…. No network connection is needed at any point.

Privacy Filter files at the pinned revision: model_quantized.onnx · model_quantized.onnx_data · tokenizer.json · viterbi_calibration.json

Qwen files at the pinned revisions: Qwen3-1.7B-Q8_0.gguf · Qwen3-0.6B-Q8_0.gguf · Qwen3-4B-Q4_K_M.gguf · Qwen3-8B-Q4_K_M.gguf · qwen2.5-0.5b-instruct-q4_k_m.gguf · qwen2.5-1.5b-instruct-q4_k_m.gguf

Troubleshooting

• “Unrecognised model file”. The file’s hash does not match any model Qvault knows. It is usually an incomplete download: download it again and re-check the hash. Do not accept an unknown file for OCR.
• “AI engine is not included in this build”. You are running a build without the bundled QVAC helper (for example a plain cargo build). Layers 1–2 still work; use an official release for AI and OCR.
• “Likely too large for this computer”. Qvault checks whether a model fits your memory before loading it. Choose a smaller model, such as Qwen3 0.6B, or use Privacy Filter without the thorough pass. The Model Manager shows each model’s memory need next to your computer’s memory before you download.
• Windows. The QVAC runtime needs a recent Vulkan driver even for CPU inference. On virtual machines or very old graphics hardware, AI and OCR may be unavailable; Layers 1–2 are unaffected.