Every file is hashed and examined on this server — file typing, entropy, known test signatures, and suspicious script patterns. No third-party lookup, nothing leaves this deployment.