The most useful thing in the LibreOffice 26.8 release announcement is not a feature. It is a sentence that says what is not there. The Document Foundation put that absence at the top of the release notes on purpose, because in 2026 the absence is the headline. When a project the size of LibreOffice commits to a verifiable offline posture, every other office suite vendor has to respond. The interesting question for me is not whether that posture is right. It is what a posture like that actually requires you to prove, and how a person who needs that posture can defend it in front of a security officer without sounding like a vendor brochure.
This is the practical checklist I ended up with after auditing half a dozen “no cloud” claims across office suites, including but not limited to LibreOffice. It is built for the sysadmin or IT lead who has to defend the deployment, not the marketing team that wrote the slogan. Some of it applies to any “we do not phone home” software. Some of it is specifically office-suite-shaped, because the file format and the macro language create a class of leakage that you would never catch with a network monitor.
The framing matters. A vendor promise that “we do not send your data anywhere” is a single sentence. The proof that the promise holds in practice is half a workday of verification. Most teams skip the second half and find out about a leak three months in.
What a no-cloud promise has to defend against
Software that runs on a desktop touches four channels that data can leave through. Network calls are the obvious one, but the others catch most teams off guard.
- Direct network calls from the executable while the suite is running.
- Indirect calls from a helper process, extension, or crash reporter that ships with the suite.
- Telemetry in error dialogs, which often ships the document path or a stack trace by default.
- The document format itself, where macros, embedded objects, or auto-generated metadata can call out to a remote service without the user noticing.
A real audit checks all four. Most teams check the first and stop. That is why “we use the offline version” is not, on its own, a posture. It is a starting position that needs work.
The four channels above also map onto two different verification techniques. Channels one and two are binary checks you can run with a packet capture on a clean network. Channels three and four are content checks that need a real human reading a real document on a real machine. Skipping either half gives you false confidence.
The packet-capture half, in fifteen minutes
For a network-level claim, the setup is small and the payoff is large. Take a clean laptop. Put it on an isolated network with a packet capture running on the gateway, or use a hosts file that points every domain at a sinkhole so you can see exactly what the software tried to reach. Open a normal document. Type for ten minutes. Save and close. Compare what the suite actually asked for against the list of domains the vendor publishes.
A usable list to start from:
- The vendor’s own telemetry and crash-reporting endpoints.
- Common CDN (content delivery network, a global cache system that speeds up static asset delivery) hosts used for fonts, icons, or help content.
- Spell-check and grammar services that ship enabled by default in most modern suites.
- Image and font family lookups, which sometimes send a hash of the input.
If a request goes out that the vendor’s documentation does not mention, that is a finding worth investigating before deployment. Spell-check in particular has been a quiet leak in multiple office suites that otherwise advertise as offline. If your threat model includes that data, the fix is disabling spell-check or pointing it at a local dictionary, not waiting for the vendor to ship a flag.
The document-format half, which is harder
The leakier channel in 2026 is the file format. Office documents have grown features over thirty years, and some of those features still call out to remote services when the file is opened. Three categories catch most of the surprises.
Auto-generated external content is the first category. Some spreadsheet and document features reference remote templates, linked images, or remote data sources that the suite silently fetches on open. The fix is a deployment policy that strips these references at upload, which most enterprise DLP (data loss prevention, a class of tooling that blocks sensitive content from leaving the protected boundary) systems already do.
Macro and scripting languages are the second category. The macro language in any office suite can reach the network if the user has permissions to do so, and a prepared document can include a macro that runs on open. If your threat model includes that surface, the answer is a deployment policy that disables macros entirely or restricts them to a signed list, not a hope that the suite is offline.
Embedded objects are the third category. PDF previews, video clips, audio embeds, and form controls can all reference external resources that the suite fetches on render. A pure-text audit will not catch this. A practical audit opens a sample of the messiest real documents your team actually uses, on a clean machine, with the packet capture still running.
Specific places where the LibreOffice 26.8 story lines up
If you read the 26.8 release notes end to end, the no-AI posture is consistent: no model picker, no cloud-only feature, no built-in integration that needs the internet to work. That is the kind of statement that, in 2026, is unusual enough to be worth defending with the audit script above, not just trusting. Two tests worth running.
First, run the packet-capture test on a fresh install of 26.8 and confirm there is no traffic on basic document open, edit, save, close. The Document Foundation’s release notes explicitly say the suite does not talk to a remote server, which is verifiable, but the macro language is open by default, so any document your team opens could still reach out if the document was prepared to do so.
Second, check the Writer, Calc, and Impress auto-content features against your deployment policy. The same workbook that opens cleanly on an internal laptop can call an external data source if it has the right cell formula, and a network monitor does not catch that because it is the spreadsheet calling, not the suite. The fix is in the file template, not the suite configuration.
Trade-offs
A no-cloud posture costs more than the marketing makes it sound. The things you actually lose depend on what you turn off.
- No AI drafting or summarization. A suite that has no AI sidebar loses the time-savings some teams have built workflows around. The honest path for those workflows is a separate product with your own API key, not a request that the offline suite change its mind.
- Reduced interop (the ability of two systems to exchange data losslessly) with cloud-native tools. Files move between suites. Some advanced Office features still do not round-trip cleanly through OOXML (the file format family behind .docx and .xlsx). If your workflow leans on those features, the loss is yours, not the suite’s.
- Some features stay disabled by policy. Spell-check pointing at a remote dictionary, auto-updates that pull from a vendor CDN, certain extension marketplaces. Each one is a small productivity hit. Together they add up.
- A smaller third-party plugin catalog. A lot of the plugins people use on other suites have no equivalent here, by design or by market interest.
The upside is real. Predictable behavior five years from now, a privacy story that fits in one sentence, a smaller attack surface that you can actually describe in an audit response. The choice is real. Make it on the merits, not on the slogan.
What I would tell past me
If I could send a message back to the version of me that decided whether to migrate a small team away from a hosted office suite, I would say three things.
- Test the no-cloud claim on a clean machine with a packet capture running. Run the suite for an hour of normal work and see what it actually asks for. If the answer is nothing, your posture holds. If the answer is a few domains, you have a list of settings to change.
- Audit your messiest documents, not your cleanest. A clean text file opens with no surprises. The leak lives in the workbook with the external data link, the document with the embedded video, the slide deck with the linked template. That is the surface you have to defend.
- Pick the suite that matches the trade-off you want to make, not the one with the loudest marketing. If you want AI on your own terms, the answer is a different product with your own key. If you want verifiable offline, the answer is a different product with no AI at all. Pretending one product does both is how you end up with neither posture in place.
LibreOffice 26.8 is not an exciting release. It is, in a year full of “AI-powered” everything, an honest one. Honest is the rarer feature, and an audit script that takes a single afternoon is what turns a slogan into a posture.