# Bates Numbering Security: Why Client-Side Processing Matters (2026)

> Understand Bates numbering security: client-side vs server-side processing, data privacy for legal documents, HIPAA compliance, and why document security matters for confidential materials.

Canonical: https://www.batesfast.com/blog/secure-bates-numbering
Last updated: 2026-09-26

Technical•March 4, 2026•11 min read

When handling confidential legal documents, security isn't optional. This guide explains why client-side Bates numbering is the only truly secure option for attorney-client privileged materials, medical records, and sensitive business documents.

![Bates Numbering Security: Why Client-Side Processing Matters](https://www.batesfast.com/blog-images/secure-bates-numbering.png)

## Table of Contents

## Understanding Security Models

Processing location affects document exposure, but security also depends on the software, device, access controls, storage, and workflow. Local processing avoids sending source files to a processing server; it does not eliminate every security or compliance risk.

Critical Security Warning

Most online PDF tools (including many popular services) use server-side processing, requiring you to upload confidential documents to their servers. This creates unacceptable security risks for legal materials, medical records, and sensitive business documents. [BatesFast](https://www.batesfast.com/)is one of the few tools that uses true client-side processing - your documents never leave your computer. Always verify a tool's architecture before processing confidential files.

### The Two Processing Models

#### Client-Side (Secure)

Processing happens in your browser. Documents never leave your device.

Zero upload risk

Complete privacy

No data breach exposure

Compliance-friendly

#### Server-Side (Risky)

Documents uploaded to remote servers for processing.

Upload exposes documents

Third-party access

Data breach vulnerability

Compliance challenges

## Client-Side Processing Explained

### How It Works

Client-side Bates numbering uses WebAssembly or JavaScript to process documents entirely within your web browser:

1. **You load the web page:** The application code downloads to your browser
2. **You select documents:** Files are read directly from your computer into browser memory
3. **Processing occurs locally:** Your browser applies Bates numbers using local computing power
4. **You download results:** Stamped PDFs are saved directly to your computer
5. **No transmission:** At no point are documents sent to any server

🔒 Local document processing

BatesFast processes source documents locally rather than sending them to a processing server. This avoids that upload step. Browser software can make network requests, so local processing is not a guarantee against device compromise or every form of data disclosure.

### Security Benefits

- **Zero upload risk:** Documents never transmitted over internet
- **No server storage:** No copies retained anywhere
- **Complete privacy:** Provider never sees document contents
- **No access logs:** No record of what you processed
- **Offline capable:** Works without internet after initial page load
- **Low data exposure:** Sign-in manages licensing, while document processing stays local

### Verifying Client-Side Processing

You can verify a tool uses client-side processing:

1. Open browser Developer Tools (F12)
2. Go to Network tab
3. Process a document
4. Check for file uploads - client-side tools show none
5. Alternatively, disconnect internet after page loads - client-side tools continue working

## Server-Side Processing Risks

### The Upload Problem

Server-side Bates numbering requires uploading your documents to the provider's servers. This creates multiple security vulnerabilities:

#### Data Breach Exposure

Your documents become part of the provider's data. If their servers are breached, your confidential documents are exposed. Major data breaches occur regularly, affecting millions of users.

#### Unauthorized Access

Provider employees may access your documents for "quality assurance," "debugging," or other purposes. You have no way to verify who views your files or when.

#### Permanent Records

Even if providers claim to delete files after processing, server logs, backups, and caches may retain copies indefinitely. You cannot verify deletion.

#### Legal Process Vulnerability

Documents stored on provider servers can be subpoenaed, searched by law enforcement, or accessed by government agencies. Your confidential materials become subject to third-party legal process.

#### Privilege Waiver Risk

Uploading attorney-client privileged documents to third-party servers may constitute a waiver of privilege. Courts have found that sharing privileged materials with third parties without proper safeguards destroys confidentiality.

### Real Breach Examples

Major document processing services have experienced breaches:

- Cloud storage providers: Millions of documents exposed
- PDF processing services: User files accessed by unauthorized parties
- Document management systems: Customer data stolen in ransomware attacks
- Legal tech platforms: Confidential case files compromised

## Compliance and Legal Requirements

### Attorney-Client Privilege

Attorneys have a duty to protect client confidences. Using server-side processing for privileged documents creates risks:

- **Inadvertent disclosure:** Uploading to third parties may waive privilege
- **Reasonable precautions:** Ethical rules require reasonable security measures
- **Client consent:** Sharing privileged materials requires informed client consent
- **Professional responsibility:** Bar associations increasingly scrutinize cloud security

### HIPAA Compliance

Local processing can reduce disclosure to a service provider. It does not by itself establish HIPAA compliance. Organizations must evaluate their safeguards and whether a provider handles PHI on their behalf. See [HHS Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) and [HHS business associate guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html).

| Requirement | Client-Side | Server-Side |
| --- | --- | --- |
| Business Associate Agreement | Depends on the provider relationship | Required when the provider is a business associate |
| PHI Transmission | None | Yes |
| Third-Party Access | Still assess device and account access | Possible |
| Breach Notification Risk | Depends on the incident and safeguards | Depends on the incident and safeguards |

### GDPR and Data Protection

Local processing can reduce transfers to a service provider. It does not remove data protection obligations; assess the lawful basis, access, retention, and security of the overall workflow. See the [European Commission guidance on GDPR principles](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/principles-gdpr_en).

## Real-World Security Scenarios

### Scenario 1: Litigation Discovery

**Situation:** You need to Bates number 10,000 pages of discovery documents containing attorney-client privileged communications.

**Server-Side Risk:** Uploading privileged documents to third-party servers may waive privilege. If the provider is breached, opposing counsel could potentially access your privileged materials.

![BatesFast Upload Area](https://www.batesfast.com/blog-images/tool-upload-area.png)

**Client-Side Solution:** Source files stay on the device during processing. Protect the device and review the disclosure workflow with counsel.

### Scenario 2: Medical Records

**Situation:** Personal injury case requiring Bates numbering of patient medical records.

**Server-Side Risk:** Review whether the provider is a business associate and whether an agreement and appropriate safeguards are in place.

**Client-Side Solution:** Source documents are processed locally. HIPAA obligations still depend on the organization, provider relationship, and safeguards.

### Scenario 3: Trade Secrets

**Situation:** Corporate litigation involving confidential business information and trade secrets.

**Server-Side Risk:** Trade secret protection requires reasonable security measures. Uploading to third parties may destroy trade secret status.

**Client-Side Solution:** Trade secrets never exposed to third parties. Protection maintained.

## Security Best Practices

### Choosing Secure Tools

- **Verify client-side processing:** Test with browser developer tools
- **Check privacy policy:** Ensure no data collection or storage
- **Avoid account requirements:** Tools requiring accounts may track usage
- **Test offline:** True client-side tools work without internet
- **Review source code:** Open-source tools allow security audits

### Document Handling

- Use client-side tools for all confidential documents
- Never upload privileged materials to server-side services
- Maintain original un-numbered documents securely
- Use encrypted storage for sensitive files
- Follow your organization's data security policies

### Professional Responsibility

- Understand your ethical obligations regarding client confidentiality
- Document your security measures and tool selection
- Obtain client consent for any third-party processing
- Stay informed about data security best practices
- Review and update security procedures regularly

## Frequently Asked Questions

### Is client-side Bates numbering HIPAA compliant?

Local processing alone does not establish HIPAA compliance. Evaluate the administrative, physical, and technical safeguards for the full workflow. Whether a BAA is needed depends on whether the provider creates, receives, maintains, or transmits PHI on behalf of a regulated entity.

### How can I tell if a tool uses client-side processing?

Open your browser's Network tab (F12 → Network) and process a document. Client-side tools show no file uploads. You can also disconnect your internet after the page loads - client-side tools continue working offline.

### Is client-side processing as fast as server-side?

Yes, often faster. Modern WebAssembly technology allows browser-based processing to match or exceed server-side speeds, without the delays of uploading and downloading large files.

### Can server-side tools be made secure?

Server-side tools can use encryption, access controls, retention limits, and contractual safeguards. Local tools avoid uploading source documents, but users still rely on the software and the security of their device.

### What about encrypted uploads?

Encryption protects data in transit, but server-side tools must decrypt files to process them. Once decrypted on their servers, documents are vulnerable to the same risks: breaches, unauthorized access, and retention.

### Which tool should I use for confidential documents?

Use [BatesFast](https://www.batesfast.com/) or other verified client-side tools. [BatesFast](https://www.batesfast.com/) processes documents entirely in your browser using WebAssembly, ensuring your confidential materials never leave your computer. It's fast, secure, and provides maximum privacy — $199 one-time purchase with one free preview run.

## Conclusion

For confidential legal documents, medical records, and sensitive business materials, local Bates numbering reduces server-upload exposure. Device security, access controls, and appropriate handling remain necessary.

Review any provider that handles confidential documents, including its access controls, retention, contractual safeguards, and incident response. Local processing avoids that particular upload step while leaving the wider security obligations in place.

### Use the Most Secure Bates Numbering Tool

[BatesFast](https://www.batesfast.com/) uses client-side processing — your documents never leave your computer. Zero upload risk. Start with one free preview run, then $199 one-time purchase.

[Try BatesFast Now](https://www.batesfast.com/app)

## Related

- [Confidential Bates Stamps: Add a Legend Above or Below the Number](https://www.batesfast.com/tutorials/confidential-bates-legend): Sometimes a production needs a printed legend alongside its Bates identifier. In BatesFast, Legend is an optional text field, separate from the counting number. This example adds CONFIDENTIAL on its own line while keeping the Bates number visible on every stamped page.
- [Bates Numbering Software in Your Browser: Local File Processing Explained](https://www.batesfast.com/tutorials/browser-bates-workflow): BatesFast reads and stamps source documents on your device in the browser. Local document processing describes where that work happens. This tutorial follows a sample file from selection to output and explains the practical checks for using a browser workspace.