Docling uses a webservice: where's the treatment of data security, protection (privacy)?

[sanmai-NL]

I find it quite amazing that you would publish a package without mentioning it sends your documents to some webservice, and not say anything about data security, data protection, confidentiality, etc.

I'm sure you can point me to the relevant documentation. But it certainly doesn't have the prominence it deserves/requires by law.

[dolfim-ibm]

This is definitely not what should happen within Docling. We are currently not aware of any communication to webservices.
If you have any evidence for it, please let us know and will quickly act to remove it.

[PeterStaar-IBM]

@sanmai-NL Please be careful with unbased accusations. If you can provide evidence where we use (in the docling-repo) a webservice or violate data security, point it out to us and we will fix it. Look here for details on how to do it: https://github.com/DS4SD/docling?tab=security-ov-file

If you are referring to the downloading of model-weights, then yes, we need to pull model weights and we leverage HuggingFace for that (like everybody else in the community). However, once the weights are downloaded, all compute is local and NO private data from the documents will be shared to any webservice.

[PeterStaar-IBM]

So far, indeed, the strange TLS traffic that emanates from your package (and its dependencies of course!) appears not to contain the documents themselves. So I retract that accusation.

Please elaborate what type of traffic you see.

[sanmai-NL]

The same problem applies to https://github.com/DS4SD/deepsearch-toolkit, I will continue discussion there.

Ok, two things:

1. The deepsearch-toolkit is by-design a SDK against our Deep Search service. So, yes, by definition it will call API

2. The deepsearch-toolkit has zero to do with docling, so you are liturally comparing apples to oranges.

Am I comparing them in terms of implementation? They're both your groups' products.

[sanmai-NL]

The same problem applies to https://github.com/DS4SD/deepsearch-toolkit, I will continue discussion there.

Ok, two things:

1. The deepsearch-toolkit is by-design a SDK against our Deep Search service. So, yes, by definition it will call API

2. The deepsearch-toolkit has zero to do with docling, so you are liturally comparing apples to oranges.

Calling an API means your product can send out any data? Are you aware of privacy law?

I'd much rather discuss this in the thread of the pertinent product.

[PeterStaar-IBM]

The same problem applies to https://github.com/DS4SD/deepsearch-toolkit, I will continue discussion there.

Ok, two things:

1. The deepsearch-toolkit is by-design a SDK against our Deep Search service. So, yes, by definition it will call API
2. The deepsearch-toolkit has zero to do with docling, so you are liturally comparing apples to oranges.

Calling an API means your product can send out any data? Are you aware of privacy law?

I'd much rather discuss this in the thread of the pertinent product.

OK, I would do some research on our products. Deep Search is a SaaS product (https://en.wikipedia.org/wiki/Software_as_a_service), which by definition will do Rest-API calls (or something very similar). We adhere to the strictest rules regarding security and privacy laws, but the latter are not preventing any SaaS business. As a matter of fact, github itself is a SaaS product, so simply engaging on a github discussion (if you are against SaaS) is inconsistent.

From my side, this discussion is closed and, unless you have actual evidence of unwanted traffic, I do not see a point to pursue this any longer.

[sanmai-NL]

Peter, your reasoning may be enough for a casual data scientist using your product experimentally and not for an organization, but falls far short of what's legally required when you, for instance, pursue the EU market.