What happens to your files
Mechanisms, not promises. Everything below describes how the service is built, because that is the only version of this page worth reading.
Check it before you read the rest
Everything below is a mechanism rather than a promise, but you do not have to take that on trust either. Three things you can verify in about a minute, without an account:
- Open your browser’s network tab and use any of the PDF tools on this site. Most of them make no request at all: the file never leaves the machine you are sitting at.
- Look at the response to an API call. The result is the body. There is no URL to fetch it from afterwards, which is the part that matters: a download link means the file outlived the request.
- Read the facts page, which is generated from the same constants this page describes, so the two cannot drift apart.
Anything here that stops being true is a bug in the service, not a wording problem on the page. python -m app.cli retention runs a request through every operation and fails the build if a single byte is written outside the memory-backed workspace.
Processed in memory, never written to persistent disk
Every request gets its own scratch directory on /dev/shm, a memory-backed filesystem. Your document is written there, the operation runs, the result is read back into the response, and the directory is removed. Nothing touches the machine’s disk, and there is no object storage anywhere in the request path.
The removal is in a finally block, not at the end of the successful path. A request that raises, hits the timeout, or is abandoned when you close the connection cleans up on exactly the same terms as one that succeeds. That last case is the one that usually leaks: a cancelled request does not raise an ordinary error, so code that only handles failures misses it.
Deleted when the request ends
There is no queue, no worker pool and no job store holding your bytes for later. The API is synchronous: the operation runs inside the request, and the response body is the result. Batch requests stream each result back as it finishes over one connection, for the same reason.
This is also why there is no “download link”. A link means the file outlived the request, and the moment that is true this page becomes a description of a retention period rather than of an absence.
Not used for training. There is nothing to train on.
No model runs in the request path. The operations are deterministic command-line tools — the same ones you could run locally — and their output depends only on their input. Your documents are not used to train anything, are not shared with any third party, and are not retained in a form that would make either possible.
What is stored
Per request, one job record:
- which account made it, and which API key
- which operation ran
- whether it succeeded, and the error code if not
- how many credits were held and how many were charged
- when it started and when it finished
Not the filename. Not the file. Not its page count, its text, or anything derived from its contents. The record exists so your credit balance can be reconstructed from an append-only ledger, which is what makes a disputed charge answerable.
Where this does not apply
Four exceptions. They are listed because one exception discovered later costs more than four disclosed now.
The free metadata inspector
That tool sends your file to the API, because reading EXIF and XMP properly is not something a browser can do. Everything on this page applies to it: memory only, deleted at the end of the request. The other free tools on this site send nothing at all — they run in your browser.
Templates you save
A saved template is markup you asked us to keep so you can render against it later, so it is stored until you delete it — that is the entire feature. It only ever contains what you sent to the templates endpoint. Documents you pass through any other operation are never turned into one.
Error diagnostics
When an operation fails, the underlying tool’s error output is returned to you and recorded in our error tracking, truncated. These messages describe document structure — a malformed object number, an unsupported filter — and not document content. We do not consider this a hole, but it is the one place bytes derived from your file travel further than the request.
Evidence capture, if you ever turn it on
Evidence capture, at exhibitseal.com, deliberately stores what it captures: a timestamped archive with nothing archived is not a product. It is opt-in per capture — the Retain as evidence tick — separately priced, and no part of any operation described above. A retained capture keeps its screenshot, PDF, HTML and WARC until you delete it, which you can do yourself from the console or with DELETE /api/v1/capture/{id}; that erases the stored files and stops the verification link resolving. If you have never ticked it, nothing of yours is stored.
Why it is built this way
Keeping files is the expensive choice. Storage costs money every month for documents nobody will read again, it turns every security incident into a disclosure with a list of affected customers attached, and it makes questions about deletion, jurisdiction and subpoenas someone’s job.
Not keeping them removes all of that, and it is why this service is sold as credits that do not expire rather than as a subscription: there is no stored state to justify a monthly charge. The privacy position and the pricing come from the same decision.
What the alternatives charge, and what they do differently
The tools people compare this against are document-privacy products sold by subscription. Two of the three process your file on their servers, which makes the guarantee on this page structurally unavailable to them: their model needs your document to be somewhere they control.
| Service | Price | How it is sold |
|---|---|---|
| Smallpdf | subscription, priced per region and not published as one figure | Monthly subscription |
| AI-Redact | from $29/mo | Monthly subscription |
| SafeRedact | $12 for 24 hours, $29/mo, or $99/year | Subscription plus per use |
| This service | $14.99 for 500 operations | Bought once, never expires |
Competitor prices taken from their own pricing pages on 2026-09-08. They change them; if one here is out of date, their page wins. Ours are on the pricing page.
The whole category argues about whether redaction is real, because drawing a black rectangle over text leaves the text in the file and that mistake has produced a long line of public disclosures. Here the glyphs are removed from the content stream, and then the file is read back with a different tool to check they are gone. If the string is still extractable, the request fails rather than returning a document that lies to you. The black box you see is painted afterwards, as a marker for a human, and is not the mechanism.
You can check that yourself on the file you get back: select the text, search it, or run pdftotext over it and grep. That is the same test the API runs before it will answer.
Where SafeRedact is the better answer: it redacts in your browser, so nothing reaches anyone’s server at all. The tradeoff they publish is that the output is re-rendered as an image, so the page stops being selectable, searchable text. That matters if somebody downstream has to quote from the document. Ours stays real text everywhere it was not redacted.
This is a description of how the service works, not a contract. https://docufinery.com/legal/retention/