How Confidential Mode works

This page explains the technical architecture of BC Clipboard OCR's confidential mode, demonstrating that no image or document data leaves your device at any point during processing. It is intended to facilitate evaluation by corporate IT teams, compliance officers and data protection officers who need to verify the tool's behaviour before approving its use within their organisation.

01 Standard mode vs. Confidential mode

BC Clipboard OCR operates in two distinct modes with fundamentally different data flows:

Aspect	Standard mode clipboardocr.com	Confidential mode clipboardocr.com/confidential
OCR engine	Anthropic Claude API (cloud)	Tesseract.js (local, in-browser)
Image data	Sent to Anthropic servers for processing	Never leaves the device
Network request during OCR	POST to /.netlify/functions/ocr	None — zero external requests
Text conversions (dates, amounts, factor)	JavaScript — runs locally	JavaScript — runs locally
Search / Multiple search	JavaScript — runs locally	JavaScript — runs locally
All-caps conversion	JavaScript — runs locally	JavaScript — runs locally
Cost per extraction	API call cost (Anthropic)	Free — no API involved
OCR accuracy	Higher — AI understands context	Good for clean, standard text
First load time	Fast	Slightly slower (Tesseract model ~10MB, cached after first load)

02 The single code difference

The entire difference between standard and confidential mode is one block of code — the OCR call. Every other function (conversions, search, formatting) is identical in both versions.

Standard mode — sends image to Anthropic API:

// Standard mode — image leaves the device
var response = await fetch("/.netlify/functions/ocr", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    imageBase64: b64,      // ← image sent to server
    mimeType: "image/jpeg",
    prompt: buildPrompt()
  })
});
var data = await response.json();
var raw = data.content
  .filter(b => b.type === "text")
  .map(b => b.text)
  .join("\n").trim();
  

Confidential mode — processes entirely in browser:

// Confidential mode — image never leaves the device
var imgDataUrl = "data:" + currentMimeType + ";base64," + currentImageBase64;
var result = await Tesseract.recognize(
  imgDataUrl,  // ← processed locally, no network call
  "eng+spa+fra+por", // multi-language model for better accuracy
  { logger: m => setStatus("Processing: " + Math.round(m.progress * 100) + "%") }
);
var raw = result.data.text.trim();

// All conversions below are identical in both modes — pure JavaScript
var converted = applyConversions(raw);
  

03 Network activity during a confidential extraction

The following shows the expected network requests when a user loads the confidential page and extracts text from an image. You can verify this yourself using your browser's DevTools → Network tab.

Browser DevTools — Network tab (confidential mode)

DocumentGET /confidential.html ~150 KB

ScriptGET cdn.jsdelivr.net/npm/tesseract.js@5/dist/tesseract.min.js ~12 KB

WorkerGET unpkg.com/tesseract.js-core — OCR engine (WebAssembly, cached) ~10 MB*

XHR/FetchPOST /.netlify/functions/ocr — NOT called —

XHR/FetchPOST api.anthropic.com — NOT called —

* The Tesseract WebAssembly engine (~10MB) loads on first use and is cached by the service worker. Subsequent uses are instantaneous with no network requests.

🔒 Your image data is never included in any network request. The only external resources loaded are the Tesseract.js library and its OCR engine — standard JavaScript dependencies, equivalent to loading any web framework. Your document content travels zero bytes over the network.

04 How to verify this yourself

You can independently confirm that no image data leaves your device using your browser's built-in developer tools:

Open clipboardocr.com/confidential in Chrome, Firefox or Edge
Press F12 to open DevTools → click the Network tab
Load an image and click "Extract text & conversions"
Filter by XHR / Fetch requests
Confirm: no POST request appears to any external endpoint
The only requests are GET requests for standard page resources (CSS, fonts, JS libraries)

💡 Tip: In Chrome DevTools, you can also go to the Application tab → Service Workers to see that the Tesseract engine is cached locally after the first load. From that point, the tool works completely offline.

05 About Tesseract.js

Tesseract.js is a JavaScript port of the open-source Tesseract OCR engine, originally developed at HP and now maintained by Google. It runs entirely in the browser using WebAssembly — a standard browser technology that allows native-speed computation without any server involvement.

Open source — Apache 2.0 licence, source on GitHub
No server — runs as a Web Worker in the browser sandbox
WebAssembly — compiled OCR engine, no native app installation required
Sandboxed — the browser sandbox prevents any unauthorised access to your system
Cached — the engine model is stored locally after first load via Service Worker
No AI context understanding — unlike Claude, Tesseract does not interpret layout or context, so accuracy may be lower on complex images

06 Data flow comparison

Standard mode:

Your device → [image] → Netlify Function → [image] → Anthropic API → [text] → Your device
  

Confidential mode:

Your device → [image] → Tesseract.js (browser) → [text] → Your device
            ← no network boundary crossed →
  

07 What still uses the network

For full transparency, the following is the only element in Confidential mode that makes a network request — and it does not involve your document content:

Tesseract.js CDN — the OCR engine library (~10 MB) is loaded from a CDN on first use only. This is the component that performs character recognition locally in your browser. After the first load it is cached by the service worker and subsequent uses require no network request at all — the tool works fully offline from that point.

🔒 Confidential mode loads no advertising, tracking or analytics scripts of any kind. The only external resource is the Tesseract.js OCR engine — a standard JavaScript dependency, equivalent to loading any web framework. Once it has been cached on first use, the tool works fully offline and makes zero further network requests.

§5 Extraction modes (C1–C4)

Confidential mode provides four extraction modes, each using a different internal document analysis strategy. None of them send any data externally — all processing remains local. The modes are designed to handle different document structures:

Mode	Best for	Document types
C1 (default)	Standard documents and labels	Product labels, receipts with clear text, screenshots, scanned documents, images with uniform layout. Also handles very wide single-line strips automatically.
C2	Complex images	Mixed layouts, multi-column pages, menus, magazines, documents with images and text combined
C3	Single-column text	Narrow labels, receipts, business cards, vertical text strips, forms with one text column
C4	Sparse or scattered text	Signs, posters, sparse ingredient lists, images where text is spread across the page without clear structure

Which mode to use: Start with C1. If the result is incomplete or misses words, try C2 for complex images, C3 for narrow vertical labels, or C4 if the text is dispersed. Most users find one mode that consistently works for their typical document type and use it by default. Your mode selection is not saved automatically — choose it each time based on the document.

Privacy note: All four modes process the image entirely within your browser. No image data, extracted text or metadata is transmitted to any server. The only network request made during extraction is to load the local OCR engine on first use (cached after that).

§6 Confidentiality of the image, events and fingerprints

This section explains precisely what data leaves your device when using Confidential mode, and what does not. We believe full transparency on this point is essential for any organisation evaluating the tool for sensitive document workflows.

What never leaves your device

The image you load — whether from a file, camera or clipboard — is processed entirely within your browser using Tesseract.js, a local OCR engine. The image itself, the extracted text, and any document content are never transmitted to any external server, API or third party. This is the core privacy guarantee of Confidential mode and it is technically enforced: there is no network call carrying image or text data.

What does leave your device

Confidential mode loads inside a standard web page, which means certain infrastructure-level data is transmitted as part of normal browser operation:

What	Destination	Can it be blocked?
Page visit (IP, user agent, referrer)	Netlify (hosting) server logs	No — inherent to any HTTP request
Tesseract.js engine (first load only)	CDN (cached after first use)	No — this is the character recognition engine that makes local OCR possible. It loads once (~10 MB) and is then cached; from that point the tool works fully offline.

No tracking, analytics or advertising scripts: Confidential mode loads no Google Tag Manager, Google AdSense or any other third-party tracking script. Page visits reach only Netlify's hosting infrastructure, as with any website. Beyond that, the only external request is the one-time load of the Tesseract.js OCR engine described above.

Browser fingerprinting

Browser fingerprinting is a technique used to identify a user across sessions based on browser characteristics (screen size, installed fonts, WebGL capabilities, etc.). BC Clipboard OCR does not perform fingerprinting, and since Confidential mode loads no third-party advertising or analytics scripts, no such script is present on the page to attempt it either.

Cookies and local storage

The tool uses browser localStorage exclusively to save non-sensitive preferences. This data never leaves your device — it is stored locally and is never transmitted. The following table details exactly what is and is not persisted:

Item	Persisted?	Reason
Language preference	Yes	UI comfort — no sensitive data
Theme (light/dark)	Yes	UI comfort — no sensitive data
All-caps toggle	Yes	UI comfort — no sensitive data
Search words (single/multiple)	No	Could reflect document content — not persisted in Confidential mode
Conversion factor / exchange rate	No	Could reflect financial context — not persisted in Confidential mode
Date format selection	No	Not persisted — resets each session
Extracted text content	No	Never stored anywhere outside the active browser session

No cookies — first-party or third-party — are set by Confidential mode. The only persisted data is the localStorage preferences listed above, which never leave your device.

Clipboard access

The "Paste from clipboard" and "Copy text" features use the standard browser Clipboard API. These actions read from or write to your operating system's shared system clipboard — the same clipboard used by every other application on your device. No clipboard data is ever sent over the network; this is purely a local, in-device data transfer between the browser and the OS.

Note for sensitive content: this is a general reminder about how the operating system's clipboard works — it applies to any website or app, not something specific to Confidential mode. Because the clipboard is shared at the operating-system level, any other application running on the same device could, in principle, read its contents while they remain there. If you paste or copy sensitive document text — here or anywhere else — we recommend clearing the clipboard afterwards (for example, by copying a short unrelated piece of text) once you have finished with it. The tool itself never reads the clipboard automatically — it only does so when you click "Paste from clipboard" or "Copy".

Summary for corporate evaluation: The image and extracted text are guaranteed to remain on your device. Standard web infrastructure metadata (IP, user agent) reaches Netlify's servers as with any website. Confidential mode loads no advertising, tracking or analytics scripts of any kind — the only external request is the one-time load of the Tesseract.js OCR engine. Clipboard operations are local to the device and never transmitted over the network.