Two processing boundaries
Merge, Split, Organize and the other one-off PDF tools run in your browser. PDF bytes, filenames, page images and document-derived metadata are not sent to a PDFOnline server. Closing or clearing a task releases the browser-held data.
The invoice workflow is deployed for staging verification but remains disabled for production uploads while email sign-in is paused and the broader production acceptance is incomplete. Its pinned processor runs on PDFOnline-managed infrastructure in Seattle, Washington, US, then sends invoice PDFs to a fixed OpenAI Responses API model for OCR and structured extraction. OpenAI response storage is disabled with store: false, but this is not a Zero Data Retention guarantee and does not make OpenAI processing Seattle-only. OpenAI uses the project's default processing region until separate data-residency and retention controls are contractually approved.
Cloud document lifecycle
Before the cloud workflow can be enabled, source PDFs and derived content must use a private object bucket and random object keys. Downloads must be authorized against both the signed-in user and their Workspace; storage URLs must never be public.
Content expires 24 hours after a batch first reaches a terminal processing state. A deletion request immediately adds a write fence and reports requested, purging, online-content-deleted/backup-expiry-pending, and verified as separate states. Backup-pending data is never described as fully deleted.
Isolation and least privilege
Every invoice-domain record carries a Workspace identifier, and production queries verify both subject and Workspace. Queue messages contain opaque identifiers only—not filenames, OCR text or extracted values. The default administration surface exposes operational state, versions, cost buckets and stable error codes, not customer content.
Hostile-file assumptions
PDFs are treated as untrusted input. Production acceptance requires MIME and magic-byte checks, structural limits, encrypted-document rejection, parser sandboxing, outbound-network restrictions, malicious corpus testing, and dependency and model license review.
Release status
The public readiness endpoint at /api/pdf/release fails closed when production pins or runtime bindings are missing. Email sign-in and payment are separate, explicit release modes. In the current release both are disabled: no email is sent, the Magic Link API returns not found, and payment endpoints remain unavailable. Fixture processing is for automated contract tests only.
Send security reports to security@pdfonline.io. Do not include a customer document or extracted value in the initial report.