Which FileNest tools actually keep working files local?
This is not a blanket 'privacy-first' slogan. The matrix below separates each reviewed snapshot workflow by where file contents are processed, whether they leave the device, whether FileNest stores the source file, and the explicit OCR cloud exception.
Current OCR routing
High Accuracy OCR follows the request route shown in the workspace before execution. Only requests admitted by the current release status, browser, language and device conditions use a FileNest browser Worker without sending source images to an external OCR API; other requests use the disclosed transient Azure Document Intelligence prebuilt-read cloud route. A FileNest browser request that has started does not automatically switch to external OCR after failure. This conditional routing description does not mean FileNest-owned OCR has fully replaced Azure.
Check the route before execution7 browser-local workflow families · 1 explicit cloud exception
The table is a pinned historical review snapshot, not a route decision for every current High Accuracy request. Its High Accuracy row describes the Azure cloud route only; see the current OCR disclosure and the workspace before execution for admitted browser requests. Review includes the image lazy runtime, source preflight and Canvas re-encoding layer, active-batch locking for data/PDF/image jobs, PDF confirmed-preview coherence, execution snapshots and settlement recovery, real JPG/PNG byte plus pdf-lib decode preflight for PDF image inputs, cross-platform cleanup for PDF outputs derived from source filenames, cross-platform cleanup for data-conversion outputs derived from source filenames, duplicate-scan isolation plus explicit partial-result labeling after stops or unreadable candidates, batch-renaming device-workset checks plus local CSV mapping parsing, strict CSV/TSV quote-state parsing, and local text-document generation plus cross-platform output-name sanitization. The Worker X-Robots-Tag change affects indexing headers only and does not alter file uploads or processing boundaries. Account, quota, analytics and billing metadata is not described as offline. OCR truth is shared; Evidence Freshness requires re-review when pinned source changes.
Pinned production commit: b9b8645f.| Workflow | Processing location | Working file leaves device? | Source file stored by FileNest? |
|---|---|---|---|
| Batch file renaming | Browser local | No | No |
| Image conversion, resize, compression and enhancement | Browser local | No | No |
| PDF merge, split, extract and images-to-PDF | Browser local | No | No |
| CSV, TSV and JSON conversion | Browser local | No | No |
| Duplicate-file detection | Browser local | No | No |
| Text to DOCX, PDF, TXT, Markdown and HTML | Browser local | No | No |
| OCR · Local Privacy mode | Browser local | No | No |
| OCR · High Accuracy cloud route (review snapshot) | Transient cloud | Yes | No |
What 'local processing' actually means
Batch file renaming
Filename rules, ordering, conflict checks, Pro CSV mapping parsing and device-workset checks run in the current browser; once download is confirmed, that preview is frozen as the execution snapshot and the workset is locked until ZIP packaging finishes, so ZIP contents, success accounting and download records use the same snapshot; invalid CSV mappings are not partially applied.
Account features may store rule templates or account-level metadata; working-file contents and CSV mapping contents are not uploaded for renaming.
Image conversion, resize, compression and enhancement
These image-processing paths run locally in the browser, including full-resolution detail sharpening and source-container preflight; generated images are downloaded directly by the user.
Authenticated or quota-based flows may create account, quota and job metadata; source images are not uploaded for these operations.
New JPG/PNG/WebP files are re-encoded; FileNest does not copy source EXIF, GPS or XMP. Keep the original if you need them.
PDF merge, split, extract and images-to-PDF
Supported PDF merge, split, page extraction and JPG/PNG-to-PDF operations, device-workset checks and multi-result safe-packaging decisions run in the browser. Before a confirmed run can start, the visible file order and processing settings must match the synchronous intent state and every input must have complete operation-preview evidence; page and output counts are recomputed from that confirmed preview and frozen into one execution snapshot before device-capacity recheck, synchronous execution lock and quota reservation, and processing, success accounting and result registration use only that snapshot. Before credits are reserved, images-to-PDF checks the actual PNG/JPEG signature and performs a decode probe with the same pdf-lib path used for final embedding; damaged, disguised or incompletely previewed inputs are blocked before quota reservation. If local results are ready but account settlement cannot be confirmed, downloads remain available while new PDF runs and setting mutations are locked; Retry account sync settles only the existing job and does not reprocess files or reserve quota again. Multi-result ZIP creation first freezes the result set and synchronously locks packaging; split and extracted output names derived from source filenames are cleaned for cross-platform invalid characters and Windows reserved names before collision numbering.
Quota and job state may be recorded by the server; PDF or image contents are not uploaded for these operations.
Encrypted PDFs, PDF OCR and PDF-to-Office are not currently supported; images-to-PDF still processes JPG/PNG only and this integrity preflight does not expand the supported format set.
CSV, TSV and JSON conversion
CSV/TSV/JSON input normalization, device-workset checks, strict quote-state parsing, preview, output serialization, safe-packaging decisions and downloadable output-name cleanup run in the current browser. Explicitly selected supported files are preserved in selection order instead of being silently deduplicated by filename, size and lastModified metadata; even identical metadata selections remain distinct inputs, while deterministic output numbering prevents overwrites. When conversion is confirmed, that run freezes its file set, target format, JSON pretty-print setting and count metadata as one execution snapshot, then uses a synchronous execution lock through local parsing, quota reservation and result registration; only files that parse successfully inside that snapshot are reserved against quota. If local results are ready but account job settlement cannot be confirmed, the results remain downloadable while new conversions and setting mutations are locked; Retry account sync settles only the existing job and does not reconvert files or reserve quota again. Multi-result ZIP creation first freezes the result set and synchronously locks packaging so repeated triggers or setting changes cannot split the downloaded archive from the visible results. Unclosed quotes, illegal quotes inside unquoted fields and illegal characters after closing quotes are rejected before conversion instead of silently rewriting data; result names derived from source filenames avoid common cross-platform invalid characters and Windows device-reserved names before batch collision numbering.
Signed-in accounts may create quota and job metadata; table or JSON contents are not uploaded for conversion.
Duplicate-file detection
Files are prefiltered by byte size and then compared using chunked SHA-256 fingerprints computed in the browser; an unreadable candidate is isolated without failing the remaining candidates. Duplicate-file CSV reports are also generated locally; if the user stops the scan or candidates are unreadable, both the UI and exported report explicitly mark the result as incomplete and the CSV records scan status, processed candidates, total candidates and unreadable count.
FileNest does not automatically delete files and does not need file-content uploads to compare fingerprints.
Text to DOCX, PDF, TXT, Markdown and HTML
Entered text, preview, built-in templates, custom backgrounds, document generation and downloadable output-name sanitization continue in the current browser; output names avoid common cross-platform invalid characters and Windows device-reserved names.
Generation counts may enter account quota and job records; body text and background images are not stored by FileNest just to generate the document.
OCR · Local Privacy mode
Local Privacy mode uses Tesseract.js in the current browser; selected images are not uploaded for OCR recognition. OCR runtime assets or language data may download on first use.
The browser may download OCR language or runtime assets on first use; account quota and job metadata may still be recorded.
Local mode does not mean a fully offline website; page assets, optional analytics and account features may still use the network.
OCR · High Accuracy cloud route (review snapshot)
After explicit user confirmation, High Accuracy mode transiently submits selected JPG, PNG or WebP images to the FileNest OCR Worker, which uses Azure Document Intelligence prebuilt-read for the recognition request. The third-party OCR provider processes that request under its service; FileNest's current implementation does not write OCR source images to R2, KV or the FileNest database.
The current FileNest implementation does not write OCR source images to R2, KV or the FileNest database; the Worker returns recognition results to the browser and settles account-level job metadata.
This is an explicit cloud exception and must not be conflated with Local Privacy OCR. The third-party OCR provider also processes the request under its service; this report must be re-reviewed when the production OCR architecture changes. The current FileNest browser route is conditional on release admission; this snapshot does not establish full replacement of Azure.
What this matrix does not claim
- 'Browser local' describes where working-file contents are processed; it does not mean the entire website is offline. Page assets, accounts, quotas, optional analytics and billing may still use the network.
- This is not a comprehensive privacy audit of the browser, operating system, extensions or third-party network environment.
- The High Accuracy cloud row applies only to the Azure route, not to admitted browser requests; the current request route is shown in the workspace before execution.