Off-Loading KYP.ai Connect App Processing to Reduce Local Resource Consumption

📄 Overview

The KYP.ai Connect App is optimized to run with minimal overhead:

• CPU usage: ~2–3%

• RAM usage: <400 MB

• Disk cache: <1 GB/day per user

However, when Image Processing and Anonymization runs locally, cumulative load increases - especially in multi-session environments.

🚀 Benefits of Server-Side Processing

• 🔻 Lower endpoint utilization – restores base 2–3% footprint.

• 📈 Predictable scaling – scales with server capacity, not user count.

• 🛠️ Centralized governance – unified management of OCR & anonymization rules.

• ⚡ Faster client log-on – reduced DLL loads and cache growth on user workstations.

• 🧾 Simplified compliance – all sensitive data handling is logged centrally.
  

🏗️ Architectural Comparison

🔹 Local Processing (Default)

• OCR Location: ✅ Performed on the endpoint device

• Anonymization: ✅ Performed on the endpoint device

• Data Flow:

  1. 📄 Raw OCR content is extracted locally

  2. 📤 OCR results (text) are sent to the server in functions directly created in the KYP Connect App

  3. 🛡️ Anonymization is performed locally on the created functions by the KYP Connect App

• ✅ Recommended for: Single-session hosts

• ⚠️ Considerations:

  • CPU load on endpoint for OCR
    

🔹 Server Processing (Recommended)

• OCR Location: ✅ Performed on the server

• Anonymization: ✅ Performed on the server

• Data Flow:

  1. 📸 Screenshots captured on endpoint

  2. 📦 Compressed screenshots are sent to the server

  3. 🔍 OCR is performed on the captured screenshots on the server

  4. 🛡️ Anonymization done by the server on the functions and screenshots

• ✅ Recommended for: Multi-host sessions or shared desktops

• ⚠️ Considerations:

  • Requires screenshots collection, which takes server`s disk space and performance

📋 Prerequisites

• 🔧 KYP.ai Server version Edinburgh 2025.03.01.01 or newer

• 🧠 Server capacity:  ≥4 vCPU per 100 concurrent users. For more recommendations, please refer to the Installation requirement guide.

• 🌐 Stable upstream bandwidth:  ≥10 Mbit

• 🔐 TLS certificates in place (see SSL Configuration section of server manual)

• 🧑 Admin access to:

  • Admin Panel → Configuration → Other → Special Settings

  • KYP Connect App Profiles
    

🛠️ Step-by-Step Procedure

⚠️ Maintenance Notice

It is important to perform changes outside business hours or through a phased rollout to minimize the impact on the data collection.

🔧 1. Enable Image Processing on Server

• Go to: Admin Panel → Configuration → Other → Special Settings

• Enable:
  IMAGE_TO_TEXT_ON_THE_SERVER_ENABLED = true
  

• (Optional) If using an external OCR engine, change the parameters mentioned below to values that correspond to your OCR engine.

  EXTERNAL_OCR_SERVICE_ENABLED = true  
  EXTERNAL_OCR_SERVICE_ADDRESS = https://ocr.example.com/api  
  EXTERNAL_OCR_SERVICE_TOKEN = [your_token]  

🔐 2. Check the Anonymization configuration

• Go to: Admin Panel → Configuration → Organization → Special Settings

• Toggle: ANONYMIZATION_RULES_ENABLED = true

• Leave CLIENT_DATA_ANONYMIZE = NONE (or set to DATA / AGGREGATED per policy if needed)

• Go to: Admin Panel → Configuration → Organization → Anonymization & Data Masking → Properties

• Change the Anonymization device to KYP Server:

  

🧩 3. Disable OCR in KYP Connect App Profiles

• Go to: Admin Panel → Service → KYP Connect App Profiles  → Operational

• For each profile:

  • ❌ Disable KYP Connect App Image to Text (OCR)

    

  • 💾 Save profile

• Apply profiles to all relevant users/machines

Note: All Screenshot Collection has to be enabled in order for the OCR to be performed on the server.

🔍 4. Verify Data Flow

• Navigate to: Admin Panel → Home → Quick Actions → Data Flow

• Confirm:

  • 📷 Confirm Screenshot and OCR Data Collection

    Navigate to the Screenshots and Functions item section and verify that screenshots are being captured correctly and that OCR-extracted content is present.

  • 📉 Monitor Hardware Metrics Panel

    Ensure that CPU usage on individual workstations has dropped to expected levels (≤3%) following the off-loading. This confirms the reduced local resource consumption.

  • 🔐 Validate Anonymization Functionality

    Check the Anonymization & Data Masking section to confirm that rules are being applied and sensitive data is being masked as expected. Make sure to select screenshots masking in the design
    

🚀 5. Roll-Out to Production

• Stage deployment:

  • 10% → 30% → 60% → 100%

• Monitor:

  • 🔔 Performance Guard Alerts (AGENT_ENABLE_PERFGUARD)

  • 📊 Server load via Prometheus / Grafana: CPU usage <70%

• Log changes in Audit Log

🛠️ Troubleshooting Tips

🔁 Rollback Plan

In case the changes need to be rolled back, so that the processing will be done on user’s workstations again, please follow these steps:

• Re-enable features in KYP Connect App Profiles ( Check the parameters mentioned here)

• In Special settings, set:

  IMAGE_TO_TEXT_ON_THE_SERVER_ENABLED = false
  ANONYMIZATION_RULES_ENABLED = false

• Change the Processing Device in Admin Panel → Configuration → Organization → Anonymization & Data Masking → Properties

• Restart Connect Apps or wait for the configuration to be retrieved from the server ( This will take up to 15 minutes) – local OCR processing resumes