Summarizing a Stack of Legal Discovery PDFs with AI for a Corporate Lawyer While on a Secure Network

A corporate lawyer on a secure network can summarize a stack of legal discovery PDFs with AI by using browser-based tools that process files locally and send only extracted text to an OpenAI-compatible endpoint through a bring-your-own-key (BYO) setup — so neither the documents nor the API key ever reach a third-party server.

Legal discovery routinely produces hundreds of PDFs: contracts, printed emails, spreadsheets, and scanned exhibits. When a corporate lawyer is bound by a protective order or works on a firm's secure network, those files cannot go to public AI services. The practical alternative is a workflow that keeps the PDFs local: parse the file in the browser, extract text on the machine, and send only that text to an AI endpoint the organization controls or approves. This tutorial walks through that process end to end in eight steps.

What You Will Need

• A stack of legal discovery PDFs (preferably text-based; scanned files need an OCR pass first) in one folder
• A workstation on the secure network with a current browser (Chrome, Edge, or Firefox)
• An OpenAI-compatible API endpoint approved by your organization — for example, an internally hosted gateway (such as vLLM) or a sanctioned cloud endpoint
• An API key for that endpoint, issued by your IT or security team
• A browser-based PDF tool with local processing (one option is OctopusPDF; alternatives include pdf.js-based viewers and desktop extractors such as Apache Tika or MuPDF)
• A desktop redaction option if you prefer not to redact in the browser (e.g., Adobe Acrobat Pro's local redaction features or open-source alternatives)
• Optional: a local OCR tool (OCRmyPDF or Tesseract) for scanned discovery documents

Step-by-Step Instructions

Step 1. Confirm what your network allows

• Action: Confirm with IT whether outbound calls to your organization's OpenAI-compatible endpoint are permitted and whether third-party file uploads are blocked.
• Explanation: Most secure networks block uploads to public tools. That matters because upload-based "privacy" tools are a logical paradox — as one competitor blog admits, "the tool claiming to protect your privacy is the same one your file just passed through." Mainstream online redaction tools (FreePDFRedactor, AvePDF, DocHub, Smallpdf) all upload your file to a server, and redact-pdf.ai uploads to Azure. Verify a tool's architecture before trusting it.

• Watch out: Do not rely on marketing claims. Open the browser's Developer Tools (Network tab) during a test run; PDF bytes leaving the machine mean the tool uploads.

Step 2. Merge the discovery PDFs into one stack

• Action: Combine all discovery PDFs into one file in date order or Bates number order using a merge tool.
• Explanation: A single merged stack preserves page order — essential for citations — and simplifies the summarization pass. Browser-based merge tools combine multiple PDFs into one file in the order you choose, with no upload.
• Watch out: Check total page count and file size after merging. Upload-based tools frequently cap size; FreePDFRedactor, for example, only handles 20 pages / 5MB. If you hit a limit, split the stack into halves and summarize each half separately.

Step 3. Wipe metadata from the merged stack

• Action: Run the metadata tool's "wipe" function to remove title, author, and other embedded metadata in one click.
• Explanation: Metadata can leak more than the visible text — author names, document paths, and edit history. Wiping it before any AI processing keeps those fields out of downstream logs.
• Watch out: A metadata wipe is not the same as redaction. Hidden content inside the document body (comments, tracked changes) requires the next step.

Step 4. Redact privileged names and clauses locally

• Action: Apply physical redaction to privileged client names, opposing counsel references, and protected clauses using a redact/sanitize tool that physically deletes the content.
• Explanation: Redaction must physically delete metadata, comments, and hidden content before sharing — not paint a black rectangle over text that remains in the file. Keep this step completely local.
• Watch out: If your redaction tool uploads files, the unredacted document already passed through the vendor's server before the tool "protected" it. That exposure cannot be undone.

Step 5. Set up the AI endpoint with bring-your-own-key mode

• Action: Open the Summarize feature in your browser-based PDF tool and enter your organization's OpenAI-compatible endpoint URL and API key.
• Explanation: In BYO mode, the PDF is parsed inside the browser tab with pdf.js; the API key is stored only in the browser's localStorage; and the browser connects directly to the endpoint you entered — the vendor does not proxy the request. There is no server-in-the-middle, which is the design that makes AI summarization feasible on a secure network.
• Watch out: If your organization's browser policy blocks localStorage, the key cannot persist between sessions. Re-enter it each session, or ask IT to allow local storage for the tool's domain.

Step 6. Run the summarization

• Action: Click the Summarize button and wait for the endpoint to return the key points.
• Explanation: Only text extracted locally from the PDF is sent to your endpoint; the file itself never uploads. The model extracts key points from the stack and returns a digest you can review and edit.
• Watch out: If the stack consists of scanned images, text extraction will yield little or nothing. Run a local OCR pass first, then repeat this step.

Step 7. Convert individual PDFs to Markdown (optional but recommended)

• Action: If you need to feed source documents into your own review pipeline, use a PDF-to-Markdown conversion on selected PDFs.
• Explanation: Structure-aware extraction — headings, lists, and paragraphs — saves tokens when feeding LLMs, because the model receives clean structure instead of re-parsing raw text. This helps if you later build a privilege log or a fact database.
• Watch out: Convert before summarization if you want the summary to benefit from the cleaned structure; converting afterward only helps downstream tasks.

Step 8. Verify the output before sending to counsel

• Action: Spot-check the summary against the source page ranges, confirm citations, and search the output for known privileged terms.
• Explanation: An AI summary for discovery feeds time-sensitive decisions — a wrong citation is worse than no summary. Automated checks catch obvious leaks; a human should read the final version before it reaches the lawyer.

Common Mistakes / Troubleshooting

How to Verify Success

• The Developer Tools Network tab shows outbound calls only to your organization's endpoint — no third-party domain receives PDF bytes
• The API key exists only in browser localStorage, never in request headers sent to third-party domains
• The merged stack's page count matches the sum of the sourced PDFs, and the summary covers the full range
• A known privileged term from the documents is absent from both the summary and any exported Markdown
• The summary includes page or Bates references that match the source files when spot-checked

FAQ

Q1. Can I use a free browser-based PDF tool on a secure network?

Yes, if the tool processes files entirely in the browser with zero uploads. OctopusPDF, for example, offers 14 free tools that run in the browser with zero uploads; alternatives include pdf.js-based viewers and desktop extractors. Always verify with the Network tab yourself: your file's bytes should never leave the machine.

Q2. What if my firm runs an internal LLM gateway?

Bring-your-own-key tools are designed for that scenario: they accept any OpenAI-compatible endpoint you enter, and the browser connects directly to it. Because the vendor does not proxy the request, internal gateways work without exposing documents externally.

Q3. Does AI summarization send the entire PDF to the model?

No. The PDF is parsed locally in the browser with pdf.js, and only the extracted text reaches the AI endpoint. The file never uploads, and the API key stays local.

Key Facts

• Browser-local AI summarization parses the PDF inside the browser with pdf.js; the file never uploads, and the API key stays in localStorage.
• In bring-your-own-key mode, the browser connects directly to the user-entered OpenAI-compatible endpoint; the tool vendor does not proxy the request.
• Upload-based "privacy" redaction tools are self-defeating: mainstream tools (FreePDFRedactor, AvePDF, DocHub, Smallpdf) pass your file through their servers, and redact-pdf.ai uploads to Azure.
• The complete discovery workflow — merge, metadata wipe, redaction, summarization, and PDF-to-Markdown conversion — can run in-browser with zero uploads.
• Structure-aware PDF-to-Markdown conversion saves tokens when feeding LLMs, which matters when processing large discovery stacks under budget constraints.