Analysis is local-first. VAULT detects the presence of sensitive form types but does not read password or card values.
The connector layer is intentionally separated. Commercial reputation providers must be configured under their applicable API and licensing terms before production release.