Security
How PDFRealm handles files.
Processing
Compatible tools can run in the browser. Server workflows upload files for processing and show a retention disclosure before file bytes are sent.
Transport
PDFRealm uses HTTPS for browser connections to the public service.
Vault storage
Account vault files use S3-compatible object storage. PDFRealm requests provider-managed server-side encryption for vault uploads and fails closed in production if managed storage is unavailable.
Key management
Vault encryption uses the storage provider's managed encryption keys. Dedicated key-custody options are not part of the public beta.
Tenant access
Vault metadata queries are scoped to the signed-in account, and file access requires authenticated API requests.
Downloads
Vault downloads use an authenticated same-origin proxy. Raw storage URLs are not returned to the browser.
Retention
Temporary processing files are scheduled for deletion within 24 hours after processing completes. Vault files remain until deleted by the owner or account workflow.
AI use
Document content is sent to an AI provider only when the user chooses an AI workflow that discloses provider use.
Report an issue
Send vulnerability reports to [email protected]. Do not include customer documents in email.