PDFs can contain private research, internal procedures, and customer data. DocKernel treats storage, retention, access, and deletion as product behavior, not footnotes.
Controls that belong in production
The local preview reads the selected file in the browser and does not upload it to the public app.
The Worker issues scoped job records and signed or account-bound downloads. AI OCR inputs are limited to 10 MB and conversion outputs expire after the configured retention period.
D1 stores identity, entitlements, job metadata, and audit-friendly payment references; raw document access stays behind authorization.
Rate limits, webhook verification, idempotent credit grants, and admin audit actions are part of the full SaaS layer.