PDFs can contain private research, internal procedures, and customer data. DocKernel treats storage, retention, access, and deletion as product behavior, not footnotes.
Controls that belong in production
The local preview reads the selected file in the browser and does not upload it to the public app.
The Worker will issue scoped job records and signed download links, with retention and deletion settings exposed before upload.
D1 stores identity, entitlements, job metadata, and audit-friendly payment references; raw document access stays behind authorization.
Rate limits, webhook verification, idempotent credit grants, and admin audit actions are part of the full SaaS layer.