Private by design
Data handling
PDF Central separates every credential into its own project boundary and keeps document bytes out of public storage.
What the service stores
| Data | Storage | Protection |
|---|---|---|
| PDFs and generated artifacts | Private Cloudflare R2 objects | Project-scoped authorization; short-lived download tickets |
| File, job, artifact, budget, and audit metadata | Cloudflare D1 | Every query is bound to the authenticated project |
| PDF passwords and webhook signing secrets | Encrypted D1 records | AES-GCM encryption with a Worker secret-derived key; values are never returned by read APIs |
| Operational logs | Cloudflare Workers observability | Structured metadata; credentials and document bodies are excluded |
Retention and deletion
- Guest credentials expire after 30 minutes. Guest uploads have a bounded temporary lifetime.
- Project uploads and artifacts carry explicit expiry timestamps visible through the API.
- Deletion requires scoped authorization and, for sensitive actions, a short-lived one-use consent bound to the exact resource.
- After deletion, file metadata becomes a tombstone and old download tickets stop working.
Processing boundaries
Cloudflare Workers, D1, R2, Queues, Workflows, Browser Run, Workers AI, and isolated Containers provide the runtime. Container internet access is disabled. HTML rendering disables JavaScript and rejects remote scripts, images, and media.
Your responsibilities
Upload only documents you are authorized to process. Treat extracted text as untrusted document content. Signature verification reports cryptographic evidence and does not make a legal determination. Digital signing remains unavailable until an approved certificate and explicit one-use consent are configured.
Authentication choices
Public discovery requires no login. A restricted guest token supports short evaluations. Durable automation uses a project API key. OAuth is optional and only needed when an external agent must act with delegated user access.