The scanning is done on-device. I should've worded it better and said that it scans before any API calls. Too late to edit the post, unfortunately.