A desktop tool that keeps client footage off the network entirely
A native desktop tool for organizing and pre-processing raw client footage entirely on-device, with a signed installer for Windows and macOS so editors never have to upload sensitive footage to a server first.
The brief, in specifics
- Industry
- Media & Publishing
- Duration
- 8 weeks
- Cooperation model
- Fixed price
- Services
- Desktop app buildLocal processing pipelineSigned installer
- Integrations
- HubSpotDocuSignXeroGoogle Workspace
- Technologies
- ElectronTypeScriptReactFFmpegSQLiteCode signing & notarization
- Team
- 1 Project lead2 Frontend engineers1 Backend engineer
Client name withheld under NDA. Engagement details are shown to the extent our agreement permits.
Nothing leaves the machine
Organizing, tagging, and proxy generation all run on-device with no network dependency.
Ingest, tagging and proxy generation all run on the workstation, with no network call in the path. The studio's footage is under embargo, and a tool that uploaded to think would have been unusable however well it worked. The catalog is a local SQLite database, so search over tens of thousands of clips is instant and doesn't depend on anyone's connection.
- Ingest, tagging and proxies all on-device, no network in the path
- Local SQLite catalog: instant search over tens of thousands of clips
- Nothing leaves the machine until the studio chooses to deliver
What is allowed to leave this workstation, step by step: ingest, catalogue, tagging and proxies have no network path, delivery goes only to a drive, and update check-ins carry build metadata. Beside it, the day's network log showing no footage sent.
Eight proxy jobs queued and one rendering, all on the editor's own machine: FFmpeg writing the proxy beside the original, and the queue holding back cores while the editing suite has the foreground.
Editing proxies locally
Proxies generated on the workstation, so an editor can start work before anything is uploaded.
FFmpeg generates edit-ready proxies on the workstation, using its available cores with a job queue that yields to the foreground so the machine stays usable while a card ingests. Proxies are written beside the originals in the structure the NLE expects, so an editor can cut immediately, with no transcode farm and no round trip.
- FFmpeg proxies generated locally on a yielding job queue
- Machine stays usable while a card ingests
- Written in the structure the NLE expects: cut immediately
Cross-platform parity
The update channel: eighteen workstations current, signed on Windows and notarized on macOS, releases shipped to both platforms together (including the early trivial test releases), and the three modules where the platforms differ.
Signed installers for Windows and macOS from one codebase, behaving the same on both.
One codebase produces signed Windows and notarized macOS builds, with the platform differences confined to file paths, the media stack and the update channel. Nothing else in the application knows which platform it's on. Both were tested on the studio's actual hardware, because parity claimed from a CI matrix and parity observed on a colorist's workstation are different claims.
- One codebase; platform differences confined to three modules
- Signed Windows and notarized macOS builds
- Parity verified on the studio's own workstations
What we were brought in to do
Editors were uploading raw client footage to a web tool for organizing and proxy generation before every project could even start, which was slow and made clients understandably nervous about unreleased footage sitting on a server.
A post-production studio whose projects began with an upload: raw camera cards to a web tool that organized, tagged and transcoded them. On a feature-length shoot that upload ran for most of a working day before an editor could open anything. Two clients had contracts that prohibited footage leaving studio machines before delivery, which made the existing workflow worse than slow for them. It was unusable.
Desktop Engineering
Where the old way broke
- 01
Raw footage files were large enough that uploads ate hours of a project's timeline, and several clients' contracts explicitly prohibited footage leaving the studio's own machines before delivery.
The upload wasn't overhead around the work; it was shaping the work. Editors batched card ingests to overnight, which meant a shoot that wrapped at six wasn't cuttable until the following afternoon, and a re-shoot discovered on day two cost another cycle. The confidentiality clause turned the same delay into a hard block for the studio's two largest clients.
We built a native desktop tool that organizes, tags, and generates editing proxies entirely on-device, packaged as signed installers for Windows and macOS with an auto-update channel, so nothing leaves the editor's machine until the studio chooses to deliver it.
What we built together
Scoped which processing steps genuinely needed to run on-device and which could go to the cloud
Each processing step was assessed for whether it genuinely needed a machine the studio didn't own, and in this workflow none of them did.
Built local proxy generation and tagging with no network dependency
Proxies are generated on the workstation by FFmpeg on a job queue that yields to the foreground, written in the structure the editing suite expects.
Packaged signed, notarized installers for Windows and macOS
Notarization was set up in week two, not at the end, because Apple's review timing is unpredictable and it's the one step that can't be hurried.
Set up an auto-update channel so every workstation stays current
The update channel keeps every workstation current, tested by shipping deliberately trivial releases before anything important depended on it.
Phase by phase
Phase 1: Draw the line
On-device versus cloud
Scoped which processing genuinely had to run locally for confidentiality, and which could be optional.
- Processing matrix
- Confidentiality boundary
Phase 2: Build local
Proxies and tagging offline
Built proxy generation and tagging with no network calls in the path.
- Proxy pipeline
- Tagging model
Phase 3: Package
Two platforms, one behaviour
Packaged signed, notarized installers for Windows and macOS and reconciled the platform differences.
- Signed installers
- Platform parity notes
Phase 4: Update
Keeping suites current
Set up an auto-update channel so every workstation stays on the current build.
- Update channel
- Rollback procedure
Tagging a day's clips: card A014's twelve takes with their tags, one clip selected, and the bin's whole tag vocabulary with its counts underneath, all written to the local catalog.
Operational results after launch
−4 hrs avg
Project start time
0
Footage leaving studio machines pre-delivery
100%
Editor workstations covered
Project start time is the change in elapsed time from card insertion to an editor opening a cuttable timeline, averaged across the first quarter's projects. Footage leaving studio machines is a policy claim, not a measurement: there's no network path in the tool for it to leave by. Workstation coverage is from the update channel's own check-ins.
Client name withheld under NDA. Figures are approximate, drawn from the engagement’s own reporting.
About our collaboration
A cross-functional team of 3 worked on a fixed price basis over 8 weeks, covering Desktop app build, Local processing pipeline, Signed installer. We ran two-week increments, each one shippable, reviewed with them before it merged. Decisions were recorded as they were made, so the reasoning survived the people who made it.
Eight weeks, fixed price, and the first decision was which steps genuinely needed a machine the studio didn't own. In this workflow, the answer turned out to be none of them. Builds were tested on the studio's own colorist and editor workstations as well as CI, because parity claimed from a build log and parity observed on a real machine are different claims.
What we'd carry into the next one
The confidentiality requirement decided the architecture. It was never a feature layered on top.
The contract clause wasn't a constraint on the design; it was the design. Any architecture with an upload in it fails the requirement, however fast the upload is.
Local proxy generation removed the upload wait that had been shaping the whole edit workflow.
Removing the wait changed the schedule more than the stopwatch: editors stopped batching ingests overnight, which is where the four hours actually came from.
One codebase across both platforms only held up because the platform differences were reconciled deliberately.
One codebase held because the differences were named and confined to three modules. Treating them as incidental is how cross-platform desktop tools usually diverge.
From camera card to delivery drive, the network lane reads zero.
Follow A014_C003, a harbor wide from day fourteen, through ingest, proxy render, tagging and export on one editor's workstation. Each stage lights what it writes to. Switch tabs, or use the arrow keys once one is focused.
The card is read on the editor's own workstation and the clip is copied to its media volume. The catalog that makes it searchable is a SQLite file on the same machine.
- Card A014 mounted on EDIT-07
- Copy A014_C003 to MEDIA-01 (M:)
- Add it to the local catalogue
Why the lane stays at zero: no stage has a network call in its path, so there is no upload to make faster or to switch off. Step timing in the replay is illustrative.
From camera card to delivery, on one machine
Electron, React and TypeScript around FFmpeg and SQLite. Four stages run on the editor’s workstation with no network dependency; the fifth is the studio’s own decision to deliver.
- 01 · SourceCamera card on the workstationRaw footage is read where the editor sits. There is no upload step before a project can start.
- 02 · IngestOrganised and tagged on-deviceIngest and tagging run on the workstation with no network call in the path.
- 03 · EngineFFmpeg proxy job queueProxies render locally on a queue that yields to the foreground, written in the structure the NLE expects.
- 04 · StateLocal SQLite catalogueSearch over tens of thousands of clips is instant and doesn't depend on anyone's connection.
- 05 · DeliveryDelivered when the studio choosesNothing leaves the editor's machine until the studio decides to deliver it.
Unreleased footage, under contract
The confidentiality clause decided the architecture
No path for footage to leave by
Ingest, tagging and proxy generation run on the workstation with no network call in the path. Zero footage leaving studio machines before delivery is a property of the design, not a setting someone could change.
Delivery is the studio's decision
Nothing leaves the editor's machine until the studio chooses to deliver it. Any architecture with an upload in it would have failed the contract clause, however fast the upload was.
Signed builds, every workstation current
Signed Windows and notarized macOS installers from one codebase, on an auto-update channel with a rollback procedure. Coverage is read from the channel's own check-ins.
Need a desktop tool for files that contractually can’t leave the building? Scope your build in 3 minutes.
Scope your buildNearby engagements
Web PlatformsA writing desk where the manuscript never leaves the machine
A desktop notebook built on Electron, where documents live on disk, the editor is a real rich-text surface, and the AI assistant reads only what the writer hands it.
Book Publishing · 14 weeks
AI & AutomationLong text becomes narrated audio, and the job tells you the truth while it runs
A production tool that pulls text out of a source, narrates it, and reports honestly on a job that takes minutes, without pretending to be instant.
Media & Publishing · 12 weeks
Web PlatformsTwo billing models in one product, and neither one pretending the other doesn't exist
A content platform sold both by subscription and as a lifetime deal, where a redeemed code and a monthly plan resolve to the same entitlement, with no parallel systems.
Media & Publishing · 18 weeks
Let's talk
Running a large platform, shaping a first MVP, or getting a product ready for a funding round? Tell us where you are. We'll shape the process around it, and stay with you after launch.
