Two processing boundaries
Merge, Split, Organize and the other one-off PDF tools run in your browser. PDF bytes, filenames, page images and document-derived metadata are not sent to a PDFOnline server. Closing or clearing a task releases the browser-held data.
The invoice workflow is a planned cloud service and is disabled in the current build. Production acceptance requires a pinned self-hosted processor image, execution bundle and independently verified processing region. Invoice content must not be routed to a third-party model API.
Cloud document lifecycle
Before the cloud workflow can be enabled, source PDFs and derived content must use a private object bucket and random object keys. Downloads must be authorized against both the signed-in user and their Workspace; storage URLs must never be public.
Content expires 24 hours after a batch first reaches a terminal processing state. A deletion request immediately adds a write fence and reports requested, purging, online-content-deleted/backup-expiry-pending, and verified as separate states. Backup-pending data is never described as fully deleted.
Isolation and least privilege
Every invoice-domain record carries a Workspace identifier, and production queries verify both subject and Workspace. Queue messages contain opaque identifiers only—not filenames, OCR text or extracted values. The default administration surface exposes operational state, versions, cost buckets and stable error codes, not customer content.
Hostile-file assumptions
PDFs are treated as untrusted input. Production acceptance requires MIME and magic-byte checks, structural limits, encrypted-document rejection, parser sandboxing, outbound-network restrictions, malicious corpus testing, and dependency and model license review.
Release status
The public readiness endpoint at /api/pdf/release fails closed when production pins or runtime bindings are missing. Fixture processing is for automated contract tests only.
Send security reports to security@pdfonline.io. Do not include a customer document or extracted value in the initial report.