What happens to my uploaded PDF file after analysis?
Web uploads may be kept after analysis to test and improve our detection algorithm, while files submitted through the API are analysed once and discarded. What happens to your PDF depends on which of the two routes you use. The analysis itself is structural: it examines the file’s technical layout and metadata, never the text or images of the document.
Route 1: the web tool
A web upload takes four steps:
- Browser to storage. Your browser asks our server for permission to upload a file of the size you selected (10 MB at most), then sends the PDF straight to Cloudflare R2 object storage over HTTPS. The upload permission is a short-lived link that is valid for five minutes and covers exactly one file of exactly that size. The file is first written to a temporary staging area.
- Admission. Our server checks that the stored file matches what you declared, copies it out of the staging area to its own location, and deletes the staged copy. A file that is too large, or that fails these checks, is deleted and never analysed.
- Analysis. The server downloads the file from storage into memory and reads its technical structure: metadata, internal structure and signatures.
- Result. The analysis results are saved to our database and shown on a result page.
Cloudflare R2 is engaged as a sub-processor only for web uploads, in the European Union. See the subprocessors list for the full roster.
Route 2: the public API
With the API you send a link to a PDF that is already hosted on your own infrastructure. We fetch the file into server memory, analyse it once and discard it. Nothing is written to Cloudflare R2, the file is never used to improve the algorithm, and only the analysis results are kept so you can retrieve them by check ID. Because the file stays with you, you are responsible for storing it. API checks are drawn from the same credits as web checks – see pricing.
What we store
- For every check, web or API: the analysis results and extracted metadata – filename, file size, creation and modification dates, creator and producer, PDF version, page count, findings and the verdict. They are tied to a unique check ID.
- For web uploads only: the PDF itself may be retained after analysis. It is used solely to test and improve our detection algorithm, and it is kept without linkage to your account. Before a retained file is used for this purpose it is dissociated from your identity, your account and any contact details. We do not state a fixed retention period for retained files.
How long the analysis results themselves are kept is covered in How long are analysis results stored?, and the exact wording is in the privacy policy.
What exists, and for how long
- While the upload is in progress: the PDF in temporary staging in EU object storage, reachable only through a link that expires after five minutes.
- During analysis: the PDF in server memory.
- After analysis, web route: the result record, and possibly a retained copy of the file with no link to your account or identity.
- After analysis, API route: the result record only. No copy of the file exists on our side.
- Result record: kept so you can reopen it later; the privacy policy sets the retention period at up to 3 years from the date of analysis.
Questions security reviewers ask
- Is the file read for its text? No. Analysis is structural; text and images are not read.
- Is the transfer encrypted? Yes, over HTTPS.
- Where is the file stored? Web uploads go to Cloudflare R2 in the European Union. API files are not stored.
- Can the result page expose the file? No. It shows verdict, findings and metadata only.
- Can I have things deleted? Yes, by writing to [email protected]; requests are handled within 30 days.
Who can see a result
- Private by default. Once a check belongs to your account, its result is visible only to you, in your dashboard.
- Share link. You can switch on a public link for an individual result. While it is on, anyone who holds that unguessable link can see the verdict and the document metadata, including the filename, without signing in. Turning sharing off revokes the link immediately. We never make a result public without that action from you.
- Anonymous uploads. If you upload without signing in, the result stays tied to the browser that uploaded it until you sign in and claim it.
- The PDF is never exposed. A result page shows findings and metadata, not the original document, so a share link never gives access to the file.
- Search engines. Result pages are marked so that search engines do not index them.
Deleting your data
To have your analysis results deleted, write to [email protected]. Requests are processed within 30 days, subject to our legal obligations to retain certain data. The same request covers any web-uploaded file we have retained: we will delete any retained copy of your upload, although a copy that has already been incorporated into an evaluation set may no longer be individually retrievable. API submissions are never stored, so for them there is nothing to delete beyond the analysis results.
Your side of the API route
Because we fetch the file from a link you provide, that link is your exposure. Use a short-lived signed URL, restrict it to the one file, and let it expire once the check has returned. Do not use a link to a folder or a public share that stays open. If the file is confidential and cannot be hosted even briefly, the check is not a fit for that document.
What this means for sensitive documents
If a document must not leave your control under any circumstances, use the API route and host the file yourself: it is analysed in memory and discarded. If you use the web tool, your file is transferred to EU-hosted storage and may be retained as described above, always without any link to your account.
Related questions
← Previous
How can I share PDF analysis results with others?
Next →
Why does my PDF show as modified even though I didn’t edit it?
Related questions
Keep reading
3 answers
Reading Your Results
Legitimate actions change a file too: re-saving, signing, filling in forms, annotating. Modified means the file has a history beyond its first creation, not necessarily fraud. Check the findings.
Not by itself. HTPBE? reports that a file was changed after creation and names each finding, but it does not label a change as harmless. A re-save, a compression pass and a content edit are all changes to the file; the named findings show what kind of change was seen.
Privacy, Data & Limits
Analysis results are kept so you can reopen them later, within the retention period set by the privacy policy (up to 3 years). The original file is handled as described in the privacy policy: web uploads may be retained in anonymised form, API files are not stored.