From Raw Scan to Database Entry

The complete transformation pipeline: turning a 1924 Bollag auction catalogue scan into a structured, queryable database record.

Two pages from a 1924 Bollag auction catalogue: Page 15 lists artworks (lots 97-102) while Tafel XIV shows 4 Hodler paintings. The challenge: reconcile text references with visual plates to create unified records.

Illustrative case: the records and processing results shown here were constructed to demonstrate the pipeline. They are not measured output.

Security & Privacy
How Your Data Stays Protected

Every step of this pipeline runs on Swiss-hosted infrastructure, with encryption in transit (TLS 1.3). Data never persists and never trains models. It is decrypted only for processing in the server's memory.

🔒
Local Processing

Scanned image stays on your computer until you initiate upload. No background syncing, no automatic cloud backup.

→
🛡️
TLS 1.3 Encryption

Data travels via an encrypted connection. Even if intercepted, it is unreadable without the decryption key.

→
🇨🇭
Swiss Server (Infomaniak)

Physical servers located in Geneva. Swiss privacy law applies (stricter than GDPR). No US Patriot Act access.

→
⚡
Volatile RAM Processing

AI models run in memory only. No disk writes. When processing completes, RAM is wiped clean.

→
📤
Return + Purge

Structured JSON returned to you. Original image deleted from server within 5 seconds. Zero persistence.

Option A

Swiss API (Agile)

Utilizes Infomaniak's AI Tools (Geneva). Data sent via TLS, processed in volatile RAM, never used for training.

  • Swiss privacy law (stricter than GDPR)
  • Zero storage persistence
  • No model training on data

This is the pipeline shown above

Option B

On-Premise GPU (Air-Gapped)

Dedicated workstation running open-weights models (Llama-3-Vision, Mistral) on internal network.

  • 100% data sovereignty
  • No bytes leave building
  • Full control over updates
Final Output: Database EntryIllustration
Query: SELECT * FROM artworks WHERE lot_number = '100';
Lot No. Artist Title Estimate Visual Tags Source
100 Hodler (Ferd.) Der liegende Stier , lying ox, cart wheel, landscape, 1879 bollag1924_11_28.pdf, p. 15 + Tafel XIV
1 record returned
This record is now searchable via natural language queries (e.g., "painting with lying ox and cart wheel") and linked to the original source document.
Concept
Outlook: documenting collections in war zones and conflict areas

A concept sketch, not implemented: no registry exists. Scenario: a museum or archive in an active war zone. Objects can be destroyed or looted, and the inventory records, often on local servers or on paper, can be lost with the building while staff are displaced. The idea: digitise and structure those records early with this pipeline, and place independent proof of them outside the affected area.

Why hashes only: a hash is a short fingerprint of a file. It cannot be turned back into the content; it can only confirm a file that someone already holds.

Why war zones and conflict areas
  • Risk: in armed conflict, collections face destruction, looting and the loss of their inventories. Servers, card files and finding aids on site can disappear together with the building.
  • Aim: capture inventory and provenance records early, process them locally (Option B stays entirely inside the building), then send out only hashes and encrypted copies.
  • Possible later use: a dated record of what the collection's documentation contained, for restitution claims, insurance, the prosecution of looting or reconstruction. Whether courts or authorities accept it as evidence is for them to decide.
  • Limits: this protects no objects, prevents no looting and does not replace off-site backups of the records themselves.
🖥️
Local

Records are digitised and hashed on the institution's own computer, inside the affected area if necessary. No readable content leaves the device.

→
🔗
Hash registry (ICP)

Would store only hash, timestamp and version details, replicated on nodes in several countries. No content. This registry does not exist.

→
🗄️
2-3 encrypted archives

Recommendation: encrypted copies with two or three independent, conventional providers in different countries. Not part of this page.

Example record, lot 100 (placeholders). This catalogue lot could equally be an inventory record of a collection.
Field Description Value
source_sha256SHA-256 of the scan (source)Placeholder, not a real value
record_sha256SHA-256 of the JSON recordPlaceholder, not a real value
pipeline_versionPipeline and model versionPlaceholder, not a real value
registered_atRegistry timestampPlaceholder, not a real value
registry_idIdentifier of the registryPlaceholder, not a real value
Note on this concept
  • This is a concept. No registry exists, and nothing is offered or stored.
  • An entry would only show that a file has existed unchanged since a point in time, and it is only useful if a copy of the file survives elsewhere. It would not show that OCR, plate matching or attribution are correct.
  • A public ICP registry would be replicated across several countries. This is deliberate: no single country, Switzerland included, should be the only place where proof of a collection's records exists. Only hashes would leave the country, never content, and processing in Switzerland (see Security) would be unaffected. The registry itself would therefore not be limited to Switzerland.

Case study by jeunet.ch - Privacy-first AI for cultural heritage institutions.   -  edouard@jeunet.ch   -  jeunet.ch