Security Guide: Why .SAM Conversion Should Stay Offline

What is actually in an Ami Pro archive

Ami Pro was at its most popular in the early-to-mid 1990s, and it was strongest exactly where documents matter: law firms, government departments, universities, hospitals, insurers, and engineering consultancies. The documents that survive from that period are not drafts and scratch notes. They are the material that was worth keeping.

In practice that means signed contracts and their amendments, litigation correspondence and case files, employment agreements and disciplinary records, patient and client letters, board and committee minutes, regulatory submissions, grant applications, land and property records, and technical specifications that may still be commercially sensitive.

These documents also tend to be under retention obligations, which is why they are still around — and being under a retention obligation usually means being under a confidentiality obligation too.

Why the "just find a converter online" instinct is dangerous

Nobody uploads a confidential document intending to breach anything. The sequence is mundane: someone needs to read an old file, discovers nothing on their PC opens it, searches for a free converter, and uploads it because that is what the website asks for. From their perspective they are reading a document. From a compliance perspective, personal or privileged data has just been transferred to an unidentified third party.

The specific unknowns are worth stating plainly, because "it is probably fine" tends to survive right up until it needs to be written down.

• Retention — how long the uploaded file is stored, and whether the deletion claim is verifiable
• Location — which country processed the data, and therefore which laws applied
• Access — who at the service can read uploads, and whether access is logged
• Subprocessors — whether conversion is delegated onward to another provider
• Secondary use — whether uploaded content is used for testing, analytics, or model training
• Breach notification — whether you would ever be told if their storage were compromised

The regulatory framing

Why local conversion changes the analysis entirely

The strength of a local desktop converter is not that it is more secure in a marginal sense. It is that the risky event does not occur. There is no upload, no third-party storage, no cross-border transfer, and no processor relationship — so the questions a compliance review asks simply do not apply.

That makes documentation trivial. Instead of a vendor assessment, a DPA, and a transfer record, the control is one sentence: conversion is performed locally on managed workstations and no document content leaves the network. Auditors can verify it with a network capture if they want to.

It also means the work can happen where the data already is — on an air-gapped machine, inside a secure records room, on a locked-down migration workstation with no internet access at all. That is impossible with any web-based tool by definition.

Practical controls for a legacy conversion project

• Run conversions on a managed workstation, ideally one with no outbound internet access during the job
• Copy the archive to a working folder and convert into a separate output tree, leaving originals untouched
• Retain the conversion log as evidence of what was processed and when
• Restrict access to the output folder to the same group that could access the source
• Give staff a sanctioned tool and tell them it exists — shadow IT thrives on unmet needs
• Write the "do not upload legacy documents to conversion websites" rule down explicitly; people follow rules they have read

The operational argument, not just the compliance one

Even setting risk aside, online converters are the wrong tool for this job. They handle one file at a time, cap file sizes, apply watermarks, and cannot see a folder tree. A real Ami Pro archive is hundreds or thousands of documents spread across nested directories, often with uppercase extensions and companion .STY style sheets that a web upload form cannot associate with the document.

Fidelity suffers too. A generic web converter has no Ami Pro parser to rely on, so it typically scrapes text — losing style sheets, tables, diagrams, and equations. You take on all the disclosure risk and get a worse result.

The secure option and the good option are the same option here, which is unusual and worth pointing out to anyone who assumes security means friction.