Handling Confidential Documents: A Guide for Legal, Medical and Finance Teams

Every professional who handles other people's confidential information eventually hits the same wall. You need to merge two PDFs, or pull a table out of a statement, or make a scan searchable. The obvious tools are free websites. And your obligations — professional, contractual or statutory — mean you cannot use them.

This is a real operational problem, and the usual workarounds are worse than people assume.

Why an upload is a disclosure

The distinction that matters is not whether a service is trustworthy. It is whether a transfer of data occurred at all.

When you upload a client file to a third-party converter, you have disclosed that document to a data processor. Depending on your framework, that may trigger obligations around processor agreements, records of processing, cross-border transfer, breach notification, and client consent. None of those are satisfied by a tool's privacy policy being reassuring.

By contrast, if the file never leaves your device, no transfer occurred. There is no processor, no agreement needed, and nothing to record. That is a categorical difference, not a difference of degree.

The workarounds people actually use, and why they fail

• "I'll just use it anyway for this one file." The risk is not that the service is dishonest; it is that you cannot evidence what happened to the data if asked.
• Emailing the document to a personal address to use a different machine. This usually creates more copies in more places than the thing it avoided.
• Printing and rescanning. Secure, slow, and destroys the text layer, which usually creates a second problem.
• Asking IT to buy Acrobat for everyone. Correct, expensive, and typically six weeks away when you need the file by four o'clock.

What to look for instead

Three categories genuinely satisfy a no-disclosure requirement:

• Desktop software. Acrobat, or open-source options like LibreOffice and Ghostscript. Nothing leaves the machine. The downsides are licensing cost and installation approval.
• Self-hosted services running inside your own network. Excellent if you have the infrastructure and someone to maintain it.
• Browser-based tools that process files locally using WebAssembly. No installation, no upload, no licence — but you must verify the claim rather than trust it.

Verifying a "no upload" claim

Treat this as due diligence, because it is. Three checks, in increasing order of rigour:

• Work offline. Load the page, disconnect the network, then process a file. If it completes, nothing was transmitted. This is the test to document.
• Inspect network traffic. Open developer tools with F12, select the Network tab, and run a conversion. Look for outgoing requests carrying file-sized payloads.
• Review the source. Client-side tools are inspectable by definition — the processing code is delivered to your browser and can be read.

Record the result of the offline test with a date and a screenshot. That is the kind of evidence a compliance review actually wants.

A workable policy

Most teams land somewhere sensible with a short rule set:

• Public or already-published material: any convenient tool.
• Internal but non-sensitive material: approved services with a reviewed retention policy.
• Client, patient, employee or financial data: local processing only — desktop, self-hosted, or verified browser-based.
• Never install a desktop "converter" obtained from a search advertisement.

Written down, this takes five minutes and prevents the ad-hoc decisions that cause incidents.

A note on scanned documents

Scanned material deserves particular attention, because the natural next step — making it searchable with OCR — is almost always done by uploading to a service. The documents people most want to OCR are contracts, medical records and discovery material: exactly the categories where upload is least acceptable.

Optical character recognition now runs perfectly well in a browser via WebAssembly. Our OCR PDF tool does this locally and produces a searchable PDF with an invisible text layer, which is the format most document management systems expect. For a fuller explanation, see how OCR works without uploading.