Hardened Images/Hardened OCR
Kapstone Hardened OCR
Document OCR for scanned PDFs, faxes and forms, processed entirely within the customer's virtual machine.
Function
A turnkey document OCR appliance. Files placed in a watch folder are returned as searchable PDFs with extracted text and tables. Built on OCRmyPDF, Tesseract and Docling.
- Monitors the watch folder
/srv/kapstone-ocr. Scanned PDFs, faxes and forms placed there are returned as searchable PDFs with extracted text and tables. - Processes faxes and scans, typed PDFs, forms and tables.
- Runs entirely on the virtual machine. There are no per-page cloud OCR fees and documents do not leave the customer's network.
- Built on OCRmyPDF, Tesseract and Docling, all open-source components, so the processing pipeline is fully inspectable.
Intended use
Health departments and agencies that receive faxed case reports, records offices digitizing paper holdings, and organizations currently paying per-page OCR fees for documents that should remain within their tenancy.
A printable one-page summary is available for procurement and security staff.
Components
- Input
- Watch folder at
/srv/kapstone-ocr - Output
- Searchable PDF; extracted text; extracted tables
- Engines
- OCRmyPDF, Tesseract, Docling (open source)
- Document types
- Faxes, scans, typed PDFs, forms, tables
- Data path
- Remains on the virtual machine
Hardening
Baseline shared by every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
Each control is explained on the Compliance page.
Evidence
Documentation issued with every release
- Built on the hardened AlmaLinux 9 base; inherits its evidence pack
- No outbound calls to external OCR services
- Open-source engines available for customer review
- OpenSCAP scan results
- Automated STIG scan output from the exact build deployed.
- DISA-format .ckl checklist
- Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.
- SBOM (CycloneDX)
- A software bill of materials listing every package and version on the image.
- Documented exceptions list
- Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.
Acquisition
Marketplace listing, free trial and private offers
Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.
Free trial: one month on Azure, 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine. See Pricing.
Specifications
| Operating system | AlmaLinux 9 |
|---|---|
| Hardening profile | DISA STIG; documented exceptions |
| Cryptography | FIPS mode enabled at installation; OS crypto policy limited to FIPS 140-3 validated modules |
| Authentication | Customer-supplied SSH keys (RSA; ed25519 rejected under FIPS) |
| Release cadence | Monthly rebuilds; evidence pack per release |
| Marketplaces | Azure first; AWS to follow. Azure Government and AWS GovCloud planned |
| Tier and price | Premium; from $0.40/hr for a Small instance. Launch range $0.40–$1.00/hr; final price set at launch |
| Support | Best-effort next-business-day by email included; paid priority support available |
| Customization | Consulting engagement, quoted separately |
Sectors
Sectors where this image typically applies
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems