Document path
Upload, queued processing, result metadata, review, and download preserve the association between a source batch and its owner. Status, sharing, cancellation, and downloads follow the same metadata model.
Jobs
Files stay tied to an authenticated user or an anonymous session owner.
Storage
Durable metadata and storage paths are checked before result access.
Queue
Workers process admitted jobs outside the web request path.
Review
Downloads and corrected output follow the same result ownership model.
Ownership
Signed-in jobs should be checked against the account that created them. Anonymous trial jobs need their original session context. That boundary matters for status polling, file preview, ZIP generation, share creation, and direct downloads. Durable database and storage metadata are the long-lived source of truth; local disk remains temporary scratch space.
Downloads and sharing
The backend verifies file metadata before returning download or share paths. A file identifier alone is not permission to read output; shared viewing follows the boundary authorized by the owner.
Operational controls
Queue admission, rate limits, OCR concurrency caps, durable job metadata, and retry-safe worker behavior are reliability controls with security value. Formal certifications are claimed only when completed and available to customers.
Questions
For security or privacy questions, use the contact path and avoid emailing sensitive source documents unless support asks for a safe sample.