Overview
OCR in an air-gapped network is not a smaller cloud OCR. It is a local pipeline with its own model supply chain, capacity planning, and evidence — and the constraints are operational, not just accuracy.
What changes when the network disappears
A cloud OCR call hides a lot: model updates, language packs, retries, and capacity. In an air-gapped environment those become your job. There are no outbound calls, so every model, font, language pack, and dependency has to arrive through a controlled path and be verified before it touches the corpus.
The hardware budget is shared. OCR competes with rendering, indexing, and the document viewer for CPU, memory, and GPU. A pipeline that works on ten scanned pages can stall on a thousand-page bid package if the queue and the worker pool were never sized. Size for the busiest week, not the average day, and leave headroom for the viewer.
The output is more than text. A useful OCR record includes the text layer, page and word coordinates, confidence scores, the model version, and the processing time. That metadata is what lets you review a low-confidence page and prove how a search result was produced.
- No outbound calls — every dependency is local and accounted for.
- Local models — language packs and layout models included.
- Signed updates — media, checksums, staging, rollback.
The local OCR pipeline
A workable pipeline is unglamorous: ingest, malware scan, rasterize, OCR, score confidence, index, and route low-confidence pages to review. The pipeline is the product; the OCR engine is one component. If the queue is invisible, operators will invent workarounds. The queue is where compliance and capacity meet: every page needs an owner and a status.
Tesseract is the reference open-source engine and a reasonable baseline for printed text; commercial on-premise engines add layout, table, and handwriting support. Tesseract's documentation is a good starting point for language data and image preprocessing.
Indexing decides whether OCR was worth it. Store the text with page coordinates, keep the original image, encrypt both, and apply retention by record class. A searchable PDF that loses the original is a convenience, not a record.
Accuracy and throughput you can defend
Measure character and word error rates by document class, not across the whole archive. Contracts, engineering drawings, receipts, and handwritten forms fail differently. Measure before you promise a percentage; a confidence threshold without a review queue is just a guess.
Throughput is measured in pages per minute on the hardware you will actually deploy, with the queue and the viewer running. Record peak load, memory pressure, and the tail latency for a 500-page package. Averages hide the pages that block a deadline.
Preprocessing earns its keep: deskew, contrast, resolution, and language selection. Tables and multi-column layouts need layout analysis, not just text extraction. Handwriting remains a separate problem; scope it explicitly.
- Ingest — source, hash, malware scan.
- OCR — engine, language data, confidence.
- Index — text, coordinates, permissions.
- Review — low-confidence queue and audit.
Model updates and supply chain
An air-gapped OCR system still needs updates: engine versions, language packs, layout models, and security patches. The update path is part of the attack surface. Use signed media, verify checksums, stage in a test environment, and keep the previous version for rollback.
Document the version matrix: engine, language data, fonts, and the test corpus used for acceptance. When a new model arrives, run the same corpus and compare error rates. A model that improves English receipts but regresses Spanish contracts is not an upgrade.
Change control should include the OCR configuration, not just the binary. Preprocessing settings, confidence thresholds, and queue priorities change output. Record them with the deployment so a search result can be reproduced months later. That record matters.
- Signed media — checksums and provenance.
- Staging — same corpus, same hardware.
- Rollback — previous model and configuration.
- Evidence — version matrix and acceptance record.
Readiness checklist
Start with one document class, one representative corpus, and one service-level target. A pilot is a benchmark, not a demo. Measure accuracy, throughput, review rate, and the time to find a page; then decide whether to expand.
- Corpus — 100–300 pages per class, including bad scans.
- SLA — pages per hour, tail latency, review turnaround.
- Update path — signed media, staging, rollback, test corpus.
- Evidence — model version, confidence, processing log.
Air-gapped OCR succeeds when the pipeline, the model supply chain, and the evidence are designed together. Start with the documents that block search today, benchmark them honestly, and expand only when the review queue is under control. If OCR is part of your air-gapped deployment, request a demo and bring a scanned package. For the access layer, see air-gapped document access; for the rendering model, see server-side PDF rasterization; for the product side, see the OCR add-on.