OCR Tool That Does Not Share Data Between Customers

To find an OCR tool that does not share data between customers, look for three things in writing: a statement that each customer's documents are visible only to that customer, no public or guessable result links, and no pooling of uploads across customers for any purpose. Then test the tool with a harmless file.

A hosted converter serves many customers from the same system. That is the ordinary arrangement and is not a fault by itself. The question for a law office is what keeps your client's scan from turning up in front of someone at another firm, or in front of anyone with a link. This post covers handling documents and is not legal advice.

What does sharing data between customers look like in practice?

Sharing data between customers rarely looks like one firm browsing another's files. It can take one of five quieter forms: a result link anyone can open, a published gallery, a pooled data set, a support or account mix-up, or a software fault that shows one account another's records.

The second and third are decisions by the vendor. The rest are design weaknesses or mistakes. A firm's diligence should cover both kinds: what the vendor intends to do with documents, and how it prevents accidents.

Another firm's user opening your scan is a client confidentiality failure you can ask about in advance. Information security here is the check that ties each stored file to one account. Keep the vendor security answer with your review notes. Personal data in a misdirected export is the incident that question is meant to prevent.

Pooling for model training is the best-known version of the third form, and it has its own post on OCR that does not train on your data. Pooling has other uses too, such as shared templates learned from customers' forms or a search index built across accounts. Ask about pooling "for any purpose", and not only training.

How do multi-customer OCR services keep firms apart?

Multi-customer OCR services keep firms apart by tying every stored document to an account and checking that tie each time anything is listed, opened or exported. The hardware is commonly shared. The separation is a rule the software enforces, backed by the vendor's own limits on which of its staff may open a file.

The shared arrangement has a standard description. The NIST definition of cloud computing, Special Publication 800-145, lists resource pooling as an essential characteristic: "The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model". So when a vendor says its service is multi-tenant, it is describing the ordinary case.

You cannot audit a vendor's code. What you can ask for is a description, in general terms, of the layers:

• Ownership on every record. Each document belongs to one account or workspace, and requests for it are refused unless the signed-in user belongs there.
• No shared outputs. Exports are generated for the account that asked and are not cached where another account could fetch them.
• Staff access rules. Named roles at the vendor may open a customer document only for stated reasons, such as a support request you raised.
• Testing. The vendor checks, or has an outside firm check, that one account cannot reach another's records.
• Other companies in the chain. If pages pass to another provider for recognition, the same separation question applies there. The post on OCR without sending documents to OpenAI explains how to find out who that is.

A vendor may offer a dedicated or single-customer deployment. Ask what exactly is dedicated, since the word can describe anything from a separate database to a separate login page.

Separation between firms is a different matter from access inside your own firm. A workspace that outsiders cannot see may still show every upload to every colleague, which matters when someone is screened from a matter. The post on private OCR covers who else can see a document in a shared workspace.

Shareable links and public result pages on converter sites

A shareable result link can put a converted document beyond its owner's control. If the output lives at an address that opens without a login, then everyone who has, guesses or finds that address has the document. The file is not protected by an account at all.

A site that needs no sign-up has little choice about this. With no account, the only thing connecting you to your converted file is the link the site hands back. A long random link that stops working after a short time is harder to stumble on than a short permanent one. Read the site's own statement on how long links work and who can open them, and treat silence as a no.

A thirty-second link test

1. Convert a blank page or a public notice. Never use a client document for a test.
2. Copy the address of the download or result page.
3. Open a private or incognito window, where you are signed out, and paste the address.
4. If the file opens, the link is the only lock.
5. Look at the address itself. A short code or a number that counts up is easier to guess than a long random string.

Where links leak

A link that works for anyone travels further than people expect. It sits in browser history on a shared computer. It gets pasted into an email or a chat to a colleague and forwarded. A document reached this way leaves no trace that tells you who opened it.

"Share" buttons inside account-based tools

A tool with accounts may add a share feature that creates a public link on purpose. That can be useful, and it reopens the same hole. Find out whether sharing can be switched off for the firm, whether shared links expire, and whether you can see a list of what is currently shared.

Schema Law's workspace commitment, quoted

Schema Law states its position on customer separation in two places, and both are quoted here as written. The list for every plan says: "Documents stay inside your own account". The homepage, under the heading "A closed system", says: "Documents stay inside the account that uploaded them. Nothing is pooled across firms, published, or made visible to other customers."

Set against the five forms in the first table, that sentence addresses three by name. "Pooled across firms" speaks to pooled data. "Published" speaks to galleries and public pages. "Made visible to other customers" speaks to cross-account access. The sentence does not mention result links or account mix-ups. The closed-system wording sits in the security section of the homepage, and the pricing page carries the six lines stated for every plan.

That is the whole of what the site says on the subject. It does not describe how the separation is built, and this post will not guess. If your firm's review needs more than the published sentence, put the questions in the next section to Schema Law as you would to any other vendor, and keep the answers.

Questions to ask a vendor about customer separation

Ask a vendor about customer separation in terms it must answer with a fact. "Is our data secure?" invites a yes. "Does a result link open for someone who is not signed in?" has only one true answer, and you can check it.

1. Is every document tied to one customer account, and is that checked on every request to view or export?
2. Do result or download links work without signing in? If so, how long do they last and how are they generated?
3. Is any customer content published, listed, indexed by search engines or shown as an example to other users?
4. Is content from different customers ever combined, for training, analytics, shared templates or anything else?
5. Which of your staff can open a customer's document, in what circumstances, and is each access recorded?
6. Do you test that one customer cannot reach another's documents, and how often?
7. If pages are passed to another company for processing, how are customers kept apart there?
8. Has a customer ever seen another customer's content in your product? What changed afterward?
9. Which sentence of your terms contains the separation promise, so we can cite it?

Question nine matters more than it looks. A sentence on a marketing page can be reworded on any afternoon. A sentence in the terms or in a signed agreement is something the firm can hold the vendor to.

Record the answers with the date, the name of the person who gave them and the version of the terms you read. If the vendor cannot answer the second question, run the link test yourself and let the result decide.