Skip to content
modelBridge Docs

Editing NDA footage

Freelance editors, agencies, and in-house teams routinely work on footage that cannot leave the machine. Marketing launches under embargo. Legal reviews of witness interviews. Corporate M&A material. Documentary interviews with source-protection agreements. If any part of that footage reaches a third-party server without permission, the contract is broken.

This guide answers one question directly: which modelBridge features are safe to use on NDA footage, and which are not?

The short answer

Section titled “The short answer”

The editing work itself is safe. Silence removal, timeline cuts, ripple-delete, timeline scans, dailies prep, LUT and grade checks — all of it runs on your computer. No media uploads to run them, and nothing reaches modelBridge’s own servers at any point.

Two things send imagery, and only one of them is opt-in. Visual scan sends up to a hundred sampled frames to Anthropic, and only when you ask for it. But chatting with a clip selected also sends frames — three to twelve sampled frames of that clip, with every message, automatically, so the agent can answer about what’s on screen. That one is on by default, and it has its own switch: Settings → Privacy → “Timeline frames to the agent”. Turning it off stops the frames for good; deselecting the clip stops them for that message.

So the safe recipe on protected material is two steps: switch off Settings → Privacy → “Timeline frames to the agent”, and skip visual scan. Do those and no frame of the footage leaves your machine, while every cleanup feature keeps working.

Deselecting the clip before you chat has the same effect message by message, and is worth knowing for the times you have the switch on. But the switch is the one to rely on under an NDA, because it does not depend on remembering.

A note on NDA mode. The same Settings → Privacy panel has a switch called NDA mode. It turns off Product analytics and Share anonymous aggregates and stops modelBridge recording anything about your generations on this machine — all worth having. It deliberately does not touch the frames switch, so turning NDA mode on is not a substitute for step one above.

One thing to weigh separately: the text of an agent conversation carries file paths, clip names, and project and sequence names to Anthropic on your own key. If the naming is itself protected — a client codename in a folder path, an unannounced product in a clip name — that travels whether or not a clip is selected.

Feature-by-feature safety card

Section titled “Feature-by-feature safety card”
FeatureSafe to use with NDA footage?What actually happens
Silence detection & measurementYesRuns on your computer via ffmpeg. Only timestamps go to Claude for reasoning.
Timeline cuts, trim, ripple-deleteYesExecuted by Premiere on your machine. No upload.
Timeline scans (offline media, frame-rate mismatches, gap detection)YesReads project metadata only. No media content leaves the machine.
Dailies prep, LUT consistency scans, bin organizationYesMetadata-only reads and writes to your local project.
Agent chat about your edit, no clip selectedYes, with a caveatClip names, timecodes, durations, file paths and project names go to Anthropic through your own API key. No imagery. Avoid sensitive project or clip names if the naming itself is protected.
Agent chat about your edit, clip selectedOnly if frames may leaveThe above, plus 3–12 sampled frames of the selected clip, automatically, with every message. Switch off Settings → Privacy → “Timeline frames to the agent” to prevent it, permanently; deselecting the clip prevents it per message.
Visual scan (scan_clip_visually)Only if you initiate itSends a handful of sampled keyframes (never the full clip) to Anthropic Claude Vision. Requires you to run the command explicitly. Skip it entirely on NDA work.
Generate tab (text-to-video, image-to-video, etc.)Only if you initiate itSends your media to fal.ai to run the AI model. Requires you to open the tab and click Generate. Skip it entirely on NDA work.
License checksYesOnly the license key and a device identifier go to LemonSqueezy. No media, no prompts, no timeline content.
Error reports (if enabled)YesAnonymous error type, HTTP status, model endpoint, plugin version. No media, no prompts, no file paths. Off by default.

Health Monitor reads source-media metadata locally for its media checks.

How to verify this yourself

Section titled “How to verify this yourself”

Trust but verify. You can confirm every claim on this page from your own machine.

Silence detection stays local. Open Chrome DevTools at localhost:8089 (Premiere Pro’s CEP debug port), open the Network panel, then ask the agent to detect silences on a clip. The only requests you should see go to localhost:3000 — modelBridge’s own local backend running on your computer. No calls to api.anthropic.com, no calls to fal.ai.

Timeline cuts stay local — and you can see the frame sampling for yourself. Same DevTools setup. With no clip selected, ask the agent to remove silences or trim clips: the Anthropic request that follows carries text metadata — timecodes, clip names, paths — and no image blocks. Now select a clip and send any message: the same request carries several image blocks. That is the sampling described above. Then switch off Settings → Privacy → “Timeline frames to the agent”, select a clip again and send another message: the image blocks are gone while the text metadata stays. Watching that is the most direct way to confirm the switch does what this page says it does.

Visual scan is transparent. When you run visual scan, the sampled keyframes are also saved to a local folder at node/uploads/scan-logs/{scanId}/ inside the plugin’s data directory. You can open the folder and see exactly which frames were sent. If the answer is “any frame at all,” and the material is under NDA, you have your answer: skip visual scan for that project.

Generate tab uploads media. DevTools Network panel will show upload requests to fal.ai domains when you generate. This is unavoidable — that is where the AI models run. If the material is under NDA and cannot be shared with fal.ai, do not use the Generate tab on that material.

Section titled “What to tell your client’s legal team”

You can hand this paragraph to a client attorney reviewing your tooling:

The Premiere Pro plugin modelBridge performs all timeline analysis, silence detection, and edit execution on the local workstation using ffmpeg and Premiere’s own scripting engine. No media, conversation content, or project data is transmitted to the vendor’s own servers at any point; what the vendor’s infrastructure does receive is limited to the subscription licence key and a device identifier, for licence validation. The AI reasoning component (Anthropic Claude, called through the editor’s own API key) receives text metadata about the project — timecodes, clip and sequence names, file paths, track structure — and, when a clip is selected in the timeline at the moment a message is sent, between three and twelve sampled still frames of that clip. Full video files are never transmitted. That frame sampling is enabled by default and is disabled permanently by the setting Settings → Privacy → “Timeline frames to the agent”, after which the reasoning component continues to receive text metadata but no imagery; deselecting the clip suppresses it on a per-message basis. Two further features transmit media to third parties only on explicit invocation: visual scan (up to approximately one hundred sampled frames to Anthropic) and generative AI (media to fal.ai). Neither is required for editing work. On protected material, disabling the frame-sampling setting and declining both features means no frame of the footage is transmitted to any third party. All of the above can be independently verified through Chrome DevTools on port 8089 while the plugin is running.

Adjust wording to match your specific NDA if needed.

Section titled “Related”