Self-Hosted OCR: When Cloud Document APIs Stop Being an Option
Cloud APIs are easy to integrate and cheap in a pilot, but the strict compliance requirements of regulated industries stop cloud-dependent workflows in their tracks. When you add per-page pricing that scales out of control, and environments that aren’t connected to the internet, and you have a few key situations where Cloud OCR is a no-go. The Apryse Server SDK OCR Module runs the entire OCR operation inside your own infrastructure. No document content is transmitted to Apryse or any third party during processing.
Fully on-premise OCR
If you want something done right, do it yourself (or at least within your own environment). The Apryse Server SDK OCR Module runs entirely inside your own infrastructure, whether that is on-premise, in a VPC, or air-gapped. It converts scanned images and image-based PDFs into searchable PDFs with selectable text layers, and outputs structured JSON or XML with text and position data. Language bindings are available for Java, Python, C#, C++, Node.js, PHP, Ruby, and Go. The module is a separately licensed add-on, and your trial key gives access to all add-ons. The SDK runs on Windows, Linux, and macOS without a GPU requirement.
Why cloud OCR APIs break in regulated environments
A document sent to a cloud OCR API leaves your environment and enters a third party's. For most workloads that tradeoff is invisible. For regulated data, this can be a dealbreaker. A HIPAA business associate agreement now has to cover the OCR vendor. A GDPR data transfer assessment has to account for where the processor sits. A SOC 2 audit scope expands to include every third-party API a document touches on its way to becoming searchable text.
The per-page pricing model adds a second constraint. Per-page numbers look manageable in a pilot, but at 100,000 pages a month, they compound into a recurring line item that scales with your document volume rather than your engineering headcount.
The Apryse Server SDK OCR Module runs the OCR operation on your own infrastructure. Licensing is flat, so processing more pages does not increase your per-page cost. This allows your platform to scale without stress.
OCR solutions compared
Documents processed inside your own infrastructure
Documents processed on AWS cloud infrastructure
Documents processed on Google cloud infrastructure
Data does not leave your environment
Data leaves your environment
YesData leaves your environment
On-premise / air-gapped supported
On-premise / air-gapped not supported
On-premise / air-gapped not supported
Tiered licenses, no per-page fees
Per page ($0.01–$0.015) pricing
Per 1,000 pages ($1.50–$30) pricing
No third-party data flow
HIPAA / GDPR architecture support with a third-party BAA required
HIPAA / GDPR architecture support with a third-party BAA required
How self-hosted OCR works
You can run self-hosted OCR on a bare-metal server, a VM, or a Docker container in your own VPC, making it ideal for sensitive and controlled data.
Every Server SDK process calls PDFNet.initialize() once at startup, before any other SDK method runs. The OCR Module is loaded as an add-on on top of the base Server SDK. In a containerized deployment, that initialization belongs in your container's startup routine, not inside the request handler. Calling it per-request adds overhead and defeats the point of a once-per-process setup.
The Default OCR Module runs on CPU. It does not require a GPU, which simplifies your container spec and keeps the deployment portable across standard compute instances. For Node.js deployments, wrap your OCR operations in runWithCleanup to handle memory cleanup between documents rather than managing it manually.
For the full picture of what runs alongside OCR on the Server SDK, see Apryse OCR capabilities.
Compliance use cases: HIPAA, GDPR, and air-gapped deployments
Self-hosted OCR helps support compliance by eliminating the risk of PHI or personal data leaving your environment through an OCR API call. That matters because the Apryse Server SDK is designed to support compliance with HIPAA, not to substitute for your own compliance program.
HIPAA
For HIPAA workflows, PHI stays inside your infrastructure through the entire OCR operation. Pair that with redaction, which removes content at the byte level rather than masking it visually, AES-256 encryption, and access permissions, to build a HIPAA-compliant document pipeline.
GDPR
For GDPR, local processing supports data residency and data minimization requirements directly. There is no third-party data flow through the SDK to account for in a transfer impact assessment, because there is no transfer.
Air-gapped deployments
For air-gapped environments, the SDK operates without network connectivity once deployed. By default, Apryse collects limited API-usage metadata, such as call names, page counts, and SDK version, but never document content. If your environment requires zero outbound traffic, you can request a no-tracking license key. Air-gapped license configuration is handled directly with Apryse, so contact sales to scope that deployment rather than treating it as self-serve.
Apryse is ISO certified
On the certification side, Apryse holds ISO/IEC 27001:2022 certification for its information security management system, held since 2018, and completed a SOC 2 Type II audit in 2024 following its first SOC 2 Type I audit in 2023. Full detail is available on Apryse security and compliance certifications.
Apryse OCR vs. Tesseract: what enterprise deployments actually require
Tesseract is free, Apache-licensed, and a reasonable choice for single-column English documents with no enterprise requirements attached. For many prototypes, it is the right starting point.
The gap shows up when a prototype becomes a production pipeline. Tesseract does not produce an annotated, searchable PDF layer by default and has no built-in JSON or XML output with position data. The Apryse OCR Module produces both from a single operation: a searchable PDF with a selectable text layer, and structured JSON or XML carrying text content and bounding boxes for downstream processing. The Default OCR Module uses deep-learning neural networks for text recognition rather than the classical recognition pipeline Tesseract relies on.
Enterprise requirements are the second gap. Tesseract ships without an SLA, support contract, SOC 2 or ISO 27001 coverage, or commercial indemnification. Those are the items a procurement or security review asks for, creating roadblocks for your compliance.
For documents with more demanding layout requirements than the Default OCR Module covers, Apryse also offers the IRIS OCR Module, a distinct, separately licensed product. Contact Apryse to confirm whether your document set falls within its scope.
Check out how AI OCR differs from traditional OCR for a broader look at where OCR fits relative to newer extraction approaches,
Java, Python, .NET, C#, C++, and Node.js
The Apryse Server SDK ships native language bindings, not wrappers, for Java, Python, C#, C++, Node.js, PHP, Ruby, and Go. The OCR Module installs on top of whichever binding you already use for the base Server SDK.
Output formats: searchable PDF, JSON, and XML
A single OCR operation produces two usable outputs. The first is a searchable PDF: your original scanned image with a selectable, searchable text layer overlaid on it. The second is structured JSON or XML containing the recognized text, bounding boxes, and page numbers, built for downstream AI, analytics, or automation pipelines rather than for human reading.
Accepted input formats are JPEG, PNG, TIFF, BMP, and image-based PDFs. For best recognition accuracy, use color or greyscale input at approximately 300 DPI. Lower-resolution scans still process, but recognition quality drops with the source image quality.
For guidance on getting the best recognition accuracy out of your source documents, read Why Document Preparation Goes Beyond OCR.
Code Samples
Getting started with Apryse OCR
Each sample initializes the SDK, opens an image-based PDF, runs OCR, and saves a searchable PDF. This feature requires the OCR Module add-on, which is a separate download from the base Server SDK.
Follow the get started guide to learn how to download and install the SDK for each framework, plus find additional code samples.
Java
Python
C#
Node.js
For C++, PHP, Ruby, or Go, see the OCR implementation guide for the equivalent pattern in your language.
