· 4 min
No-upload pipelines by design
A “no-upload” requirement needs a testable boundary. Write down exactly which files must stay inside the studio, which destinations are approved, and what would count as an exception. Then trace the image from intake to delivery, including services that operate quietly in the background.
Inventory every route out
List the generation application, plugins, model downloads, license checks, crash reporting, analytics, cloud-sync folders, remote desktops and review tools. Note whether each one can send source images, prompts, thumbnails, logs or account identifiers outside the workstation. Treat the model and its updates as dependencies with an owner and an approved transfer path; avoiding a public inference API does not mean the rest of the machine is offline.
Decide where original images, temporary crops, caches, checkpoints, review copies and final exports may live. Set a separate location for each project, restrict access, and document the route for an approved file to leave the environment. If a cloud review service is allowed for low-sensitivity previews, state which files qualify and who grants approval. Do not let an editor infer the rule from a folder name.
Prove the boundary on a test job
Use non-client material and observe the workstation while it imports, generates, saves and exports. Check firewall or network logs, DNS requests, sync queues and application settings. Then block unapproved egress and repeat the workflow. Confirm that the job either succeeds without the prohibited destination or fails visibly instead of silently saving a copy somewhere unexpected. Keep the result with the workflow version and repeat the check after meaningful software or plugin changes.
Make a no-upload checklist
- Define allowed destinations and a named exception approver.
- Disable or configure telemetry, auto-sync and external review features.
- Keep source, cache, output and backup locations in the data-flow diagram.
- Use a visible pause process if a tool unexpectedly requires a public service.
- Verify cleanup of temporary files and the backup policy at project close.
The NIST Privacy Framework is a voluntary resource for identifying data-processing activities and privacy risks. For face images, read face policy for private image work; for reviewers’ decisions on generated batches, read batch image quality gates. Discuss a controlled workflow through services or contact.