Air-gapped workstations still receive CSV attachments on USB. A static build of a browser tool, delivered through approved channels, can run without calling home, verify against your security team that no third-party scripts remain.
Checklist
- Disable or audit analytics and ads in hardened builds.
- Document data flow in the system security plan.