Team tools that keep files in-house
PDF, image, data and video work, done inside each person's computer. Setting up means opening a browser.
AI Mask (free): ask generative AI without giving away what is confidential
When staff ask ChatGPT, Copilot, Claude and the like, company and people's names, amounts and phone numbers go as placeholders such as 【Company A】, and the answer gets the real names back. The masking and the list of placeholders stay on each person's computer. No Pass needed.
Use AI Mask →Why teams choose it
Files are not uploaded
Files are processed on the computer and never uploaded to a server. What does go out is in the table below.
In bulk, on autopilot
Many files at once. Save the steps, and next time it is one click.
Ready in a minute
No install, no accounts. One key works on five computers.
What each team does with it
Admin and finance
HR
Communications
Sales and legal
For your IT review
- Files are not uploaded (the work happens on the device)
- No accounts. No personal details collected
- File contents are never sent to a server (Send delivers straight to the other person's device). Connections are listed in the table below (the Pass check, anonymous counts, AI models when you use AI)
- Once open, works without an internet connection
- Use is counted anonymously, in fixed categories, and "do not track" is honoured
IT review sheet: every connection
Where an Orihako page may connect is fixed by each site's security policy (CSP); the browser blocks loading from or sending to anywhere else. The table below lists those connections. Send's direct device-to-device connection is outside that policy, so it has its own rows.
| Site | Connects to | Why | Your files |
|---|---|---|---|
| All | orihako.com | Pass check and anonymous use counts | Never sent |
| orihako.com, PDF, Photo, Stream, Chat, Image, Data, Translate, Send, Find | static.cloudflareinsights.com, cloudflareinsights.com | Page views (Cloudflare Web Analytics, no cookies) | Never sent |
api.lemonsqueezy.com | Activates a Pass (only when you buy one) | Never sent | |
cloud.umami.is, gateway.umami.is, api-gateway.umami.dev | Page views and which screens were opened (Umami, no cookies) | Never sent | |
| Chat, Find | huggingface.co, *.hf.co | Downloads an AI model (once, after you agree; kept afterwards) | Never sent |
| Chat | raw.githubusercontent.com | Downloads the AI runtime (once, with the model) | Never sent |
| Chat | 127.0.0.1 | An AI running on this computer (Ollama etc., only if you use one) | Never sent |
| Send | send.orihako.com | Sets up a hand-over (matches the six-digit code only) | Device to device, directly (not through a server) |
| Send | stun.l.google.com | Finds the addresses two devices need to connect directly (a public STUN server; no file passes through it) | Never sent |
What stays on the device
Files being worked on are handled in the browser's memory. What stays: each step's files and results for 24 hours after the last step, so Back and "Continue from this step" find them ("close this work", or a setting on the work history page, keeps none), downloaded AI models, saved recipes, settings, the Pass token, and what you chose to keep (results saved under "Continue", Chat conversations and library files) and the work history (when, which tool, file names and sizes, never contents; a setting keeps no names) - all inside this browser only, removed by clearing the site's data.
How to check it yourself
1) Open a page, turn Wi-Fi off, then process a file (for AI, after the model has downloaded). 2) Keep the browser's developer tools open on Network while you work and see that nothing outside this table is contacted.
AI Mask (free)
Before asking a generative AI, names and amounts become placeholders such as 【Company A】, and the answer gets the real names back. The list of placeholders stays on the person's computer. A name finder (a few hundred MB) is read once from orihako.com only if the person chooses it. No Pass needed.
Reporting a problem
Reports use a Google Form. Everything is shown before it is sent, and file contents and names are not included
Edge and Chrome policy: allow this site, install the app for everyone
For company computers set up centrally with Group Policy or Intune. The policy names below are the ones in Microsoft's and Google's public documentation.
1. Allow this site
If URLs are blocked broadly (URLBlocklist), add this one line to URLAllowlist as an exception. Written without a leading dot, orihako.com also covers every name under it, such as pdf.orihako.com. Edge calls the policy "Define a list of allowed URLs".
orihako.com2. Install the app for everyone
Put this value in WebAppInstallForceList (one line). The app installs without the person doing anything, and they cannot remove it. Edge calls the policy "Configure list of force-installed Web Apps", Chrome "Configure list of force-installed web apps".
[{"url":"https://pdf.orihako.com/","default_launch_container":"window","create_desktop_shortcut":true}]Other Orihako tools go in the same list, one entry each, with the address of their front page.
3. Where to set it
- Group Policy: Administrative Templates > Microsoft Edge (Edge), and Administrative Templates > Google > Google Chrome (Chrome).
- Intune: in the settings catalog, search for the policy name.
- Edge's registry key: SOFTWARE\Policies\Microsoft\Edge (URLAllowlist is a sub-key with values 1, 2, 3 ...).
To look them up
Microsoft Edge policy URLAllowlistMicrosoft Edge policy WebAppInstallForceListChrome Enterprise policy list WebAppInstallForceList
Checked against the public documentation in October 2026. Names and places can change between browser versions: check the current documentation before you roll it out.
An AI-use policy, ready to adopt
Most worry about confidential data going into AI comes from having no rule. Enter your company's name and a start date to get a policy you can hand out, as a Word file. It is made in this browser.
A template: adapt it to your company and have it reviewed where needed.
Tools that make the rules easy to follow
For section 4 (what must not go in) and section 6 (records), in everyday work.
Records and recipes for the whole team
When someone new takes over, the steps stay. The recipes you hand out work the same for the new person from one link, and each person's signed work history can be put together to see who did which steps.
Business
Five computers, one year. Every feature of every tool.
5 computers (browsers)¥29,800 (≈ US$189)a yearBuyOne-page overview for the approval → Make a quote →
Payment is by card, PayPal, Apple Pay or Google Pay for now (no invoice payment or bank transfer yet). For more than five computers or any question, write to us.
Email usorihako.support@gmail.comReceipts and invoices
Lemon Squeezy, the seller, issues them, in three steps:
- The purchase e-mail from Lemon Squeezy is the receipt.
- In Lemon Squeezy's "My Orders" (reached from that e-mail), make the invoice: the company's name goes in the name or the note, with the address.
- Save the invoice as a PDF.
Whether these invoices meet Japan's qualified invoice rules is not confirmed yet.