Editing NDA footage
Freelance editors, agencies, and in-house teams routinely work on footage that cannot leave the machine. Marketing launches under embargo. Legal reviews of witness interviews. Corporate M&A material. Documentary interviews with source-protection agreements. If any part of that footage reaches a third-party server without permission, the contract is broken.
This guide answers one question directly: which modelBridge features are safe to use on NDA footage, and which are not?
The short answer
Section titled “The short answer”The cleanup features are safe. Silence removal, timeline cuts, ripple-delete, timeline scans, and every other action that only needs to read metadata from your project run on your computer. Nothing uploads. The reasoning that happens with Claude only sees timestamps, clip names, and track structure — never your video content.
The AI-vision and AI-generation features are opt-in per action. Visual scan sends sampled keyframes to Anthropic when you explicitly ask Claude to look at footage. Generative AI sends media to fal.ai when you use the Generate tab. Both require a deliberate action on your part — they never run in the background, and skipping them entirely does not disable anything else.
An editor who uses only the cleanup features on NDA material will not send a single frame of that material to any external server.
Feature-by-feature safety card
Section titled “Feature-by-feature safety card”| Feature | Safe to use with NDA footage? | What actually happens |
|---|---|---|
| Silence detection & measurement | Yes | Runs on your computer via ffmpeg. Only timestamps go to Claude for reasoning. |
| Timeline cuts, trim, ripple-delete | Yes | Executed by Premiere on your machine. No upload. |
| Timeline scans (offline media, frame-rate mismatches, gap detection) | Yes | Reads project metadata only. No media content leaves the machine. |
| Dailies prep, LUT consistency scans, bin organization | Yes | Metadata-only reads and writes to your local project. |
| Agent chat about your edit | Yes, with a caveat | Clip names, timestamps, and durations go to Anthropic through your own API key. Your video file never does. Avoid using sensitive project or clip names if the naming itself is protected. |
Visual scan (scan_clip_visually) | Only if you initiate it | Sends a handful of sampled keyframes (never the full clip) to Anthropic Claude Vision. Requires you to run the command explicitly. Skip it entirely on NDA work. |
| Generate tab (text-to-video, image-to-video, etc.) | Only if you initiate it | Sends your media to fal.ai to run the AI model. Requires you to open the tab and click Generate. Skip it entirely on NDA work. |
| License checks | Yes | Only the license key and a device identifier go to LemonSqueezy. No media, no prompts, no timeline content. |
| Error reports (if enabled) | Yes | Anonymous error type, HTTP status, model endpoint, plugin version. No media, no prompts, no file paths. Off by default. |
How to verify this yourself
Section titled “How to verify this yourself”Trust but verify. You can confirm every claim on this page from your own machine.
Silence detection stays local. Open Chrome DevTools at localhost:8089 (Premiere Pro’s CEP debug port), open the Network panel, then ask the agent to detect silences on a clip. The only requests you should see go to localhost:3000 — modelBridge’s own local backend running on your computer. No calls to api.anthropic.com, no calls to fal.ai.
Timeline cuts stay local. Same DevTools setup. Ask the agent to remove silences or trim clips. The Anthropic API request that follows contains text metadata — timestamps, clip names — but no video blob and no image blocks.
Visual scan is transparent. When you run visual scan, the sampled keyframes are also saved to a local folder at node/uploads/scan-logs/{scanId}/ inside the plugin’s data directory. You can open the folder and see exactly which frames were sent. If the answer is “any frame at all,” and the material is under NDA, you have your answer: skip visual scan for that project.
Generate tab uploads media. DevTools Network panel will show upload requests to fal.ai domains when you generate. This is unavoidable — that is where the AI models run. If the material is under NDA and cannot be shared with fal.ai, do not use the Generate tab on that material.
What to tell your client’s legal team
Section titled “What to tell your client’s legal team”You can hand this paragraph to a client attorney reviewing your tooling:
The Premiere Pro plugin modelBridge performs all timeline analysis, silence detection, and edit execution on the local workstation using ffmpeg and Premiere’s own scripting engine. The AI reasoning component (Anthropic Claude, called through the editor’s own API key) receives only text metadata about the project — timestamps, clip names, track structure — and never the video files or any frames extracted from them. Two separate features (visual scan and generative AI) transmit media to third parties (Anthropic and fal.ai respectively), but only when the editor explicitly invokes them, and neither is required for editing work. Both can be avoided entirely on protected material. Network traffic can be independently verified through Chrome DevTools on port 8089 while the plugin is running.
Adjust wording to match your specific NDA if needed.
Related
Section titled “Related”- Privacy Controls — full data-flow breakdown across every plugin surface
- Agent Mode — how the editing assistant is architected
- Privacy Policy — full legal privacy policy