PDF Tools for Lawyers: Client Confidentiality, No Upload

An opposing exhibit to annotate, two drafts of a brief to compare, 400 pages to stamp before production: PDF is the working format of every practice. The temptation is real to drop those files on the first free tool that comes up. That is precisely what confidentiality duties forbid — and what fully local processing makes unnecessary, without changing your habits.

Why uploading a case file is an ethics problem

Whatever your jurisdiction calls it — attorney-client privilege, professional secrecy, duty of confidentiality (ABA Model Rule 1.6 in the US; in France, article 66-5 of the law of December 31, 1971 covers “all documents in the file”) — the principle is the same: client materials may not be disclosed to third parties without authorization.

Dropping a file on an online service does exactly that, twice over:

• Confidentiality: the document becomes accessible to the provider, its subprocessors, its logs and its backups. Deletion promises (“files erased within the hour”) are unverifiable from the outside.
• GDPR: a service that receives personal data to process it becomes a data processor under Article 28 — requiring a processing agreement (DPA), a record entry and, for non-EU providers, transfer safeguards. Free tools almost never offer a DPA.

A tool whose processing runs inside your browser removes the problem at the root: no transfer means no third-party recipient and no processor for that step. And unlike a privacy policy, it is verifiable — open your browser’s Network tab, drop the file, and watch whether any request carries the document. The pillar article on PDF tools without upload walks through the test.

Fellowes 60Cs — 10-sheet shredderTen sheets per pass and a 22 L bin: sized for regular office use.affiliate

The full workflow, with no file leaving the workstation

Assemble the bundle

The merge tool combines 2 to 20 PDF files (50 MiB total): pleadings, exhibits, appendices. The organize tool reorders, rotates, deletes or extracts pages by thumbnail — handy for removing a stray cover page or matching the index order.

Bates-stamp for production

Bates numbering gives each page a unique reference (EXH-0001, EXH-0002…). In the PDF editor, the Bates panel takes a prefix, a start number, a digit count (1 to 10), a suffix, one of four corner positions and a font size. Sound convention: stamp last, once the bundle is frozen — details in the Bates numbering article.

Redact what must disappear

Before producing a document — to opposing counsel, an expert, a requesting third party — irrelevant personal data must be masked. Beware the classic trap: a black rectangle drawn over text leaves it extractable. A 2023 study published in PoPETs (Story Beyond the Eye, Bland et al.) found 769 vulnerable redactions in a corpus of over 22,000 US court documents from PACER — the failure is common, including among professionals.

The redaction tool works differently. When the file opens, a local scan flags nine types of personal data: IBANs (mod-97 check digit), French social security numbers, bank cards (Luhn-validated), SIREN and SIRET, email addresses, phone numbers, context-marked birth dates and IPv4 addresses. You tick the occurrences to mask. For what detection does not know — proper names, addresses, internal references — a keyword mode redacts every occurrence of a term you type. Affected pages are then rasterized to images: the text under the masks no longer exists as a text object and cannot be recovered. Full walkthrough in the article on redacting personal data.

Compare two versions of a pleading

Opposing counsel’s amended brief, a settlement draft returned with “minor tweaks”: the comparison tool shows text differences line by line, page by page (additions and removals flagged, HTML output). Honest limits: comparison runs on extracted text, not visuals — a moved clause is caught, a swapped logo is not — and it needs a text layer. A flat scan goes through the local OCR first (Tesseract, five languages including English, 100 pages maximum). See the tutorial on comparing two PDFs.

Extract, clean, send

To produce only an excerpt, the extract tool outputs a new PDF limited to the chosen pages. Before sending, the cleanup tool optionally removes metadata (author, history), JavaScript, attachments and annotations — traces that redaction does not touch. If the file will travel, the protection tool encrypts it with a password.

What local guarantees — and what it does not

Precision matters here. Local processing guarantees one verifiable thing: no network request carries your document. There is therefore no server retaining the file, no provider to contract with for that handling, no retention window to hope is honored.

Local does not guarantee the rest. A workstation compromised by malware, a prying browser extension, an unlocked session: a locally processed document remains exposed to your environment’s security, which falls under the firm’s usual measures. And local is not a certification: it removes the processor question for this step, not your professional responsibility or your overall security obligations. For the full framework, see our article on GDPR and local PDF processing.

Checklist before producing a bundle

1. Assemble the documents and freeze the order (merge, thumbnail organization).
2. Bates-stamp — last, once nothing moves.
3. Redact irrelevant data, then verify: open the produced PDF and try copying text under a black area — nothing must be selectable.
4. Clean metadata, annotations and stray attachments.
5. Check in the Network tab that no request carried the document.
6. Protect with a password if the file travels, and share it over a separate channel.

Disclaimer

This article is informational content about a tool and a workflow; it is neither legal advice nor an analysis of your situation. The applicable duties depend on your jurisdiction and bar rules — your own professional regulation is the reference.

Every operation described runs in your browser, like the rest of the catalog covered in our article on PDF tools without upload. No file leaves your workstation — and you can verify that yourself rather than take our word for it.

And for the paper originals?

Fellowes 60Cs — 10-sheet shredderTen sheets per pass and a 22 L bin: sized for regular office use.affiliate Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate Rexel Secure MC4 — P-5 micro-cutCompact micro-cut for occasional home use.affiliate