Why are we still uploading confidential PDFs to cloud servers just to merge pages?

When building web tools in 2026, many of us default to standard microservice architecture:

1. The user uploads sensitive documents (bank records, tax PDFs, contracts) over the wire.
2. A backend server (Python/PyPDF2, Poppler, or headless Chrome) spins up CPU threads to stitch pages.
3. The server stores temp files, burns egress bandwidth, and exposes document PII to server compromise.

I recently transitioned our PDF suite at UtilifyAI (utilifyai.com/tools/pdf-merge/) to a 100% client-side zero-server architecture using pdf-lib and browser WebAssembly/Blob APIs.

The results:

• $0 compute/storage overhead: Client CPU handles ArrayBuffers directly.
• Instant GDPR & HIPAA compliance by default: Files literally never touch an external server or wire.
• Offline resilience: Works with spotty connection once cached.

I wrote a complete code breakdown here on Dev.to: How to Merge PDF Files in the Browser Without Server Uploads.

Discussion Question:
For developers building client-side tools: where do you draw the line between client-side processing (memory pressure on low-end devices) vs. server-side offloading? Have you transitioned other traditionally backend operations (image compression, EXIF scrubbing, OCR) entirely to the browser?