Quarantine
Browser-direct, tenant-scoped intake. Document bytes never pass through the application or the database.
RECORDSECURITY & DATA PATH
Where your documents go,
and what never sees them.
This page holds no certification and claims none. What it can tell you is the path a document takes, which component is allowed to hold it, and what this deployment is not permitted to do at all. Every external operation fails closed — a control opens only after the one before it is qualified.
THE BOUNDARY, IN THE ORDER IT IS ENFORCED
Sanitize
Antivirus and mandatory content disarm, with the sanitization proof kept as evidence.
Understand
Only sanitized artifacts reach analysis. A parser gets no tools, no broad credentials, no outbound network.
Review
A person decides before anything is promoted. Automated analysis produces a candidate, never a world.
WHAT HOLDS WHAT
The browser
Holds a short-lived, narrowly scoped upload capability, issued only after the server has checked who you are, what you are entitled to, and what quota is left. It never holds a service key, a webhook secret, storage credentials or a signing credential.
Object storage
Tenant-scoped quarantine holds the bytes. This is the only place a document body exists.
The application
Coordinates contracts and never proxies a document body. A large file does not pass through a request handler.
The database
Stores metadata and immutable proof references. It never stores document bytes.
Tenant identity is derived server-side from an authenticated session, never from an identifier the browser supplies. Provider credentials — authentication, billing, storage, content disarm — are managed server-side secrets; the browser may hold a provider’s own publishable token and nothing else.
CURRENT DEPLOYMENT CONTROLS
Customer document intake
Foundation private-pilot intake is approved after synthetic R2 qualification. Files go to the Foundation quarantine bucket only.
Content disarm and reconstruction
Foundation CDR Worker sanitizes quarantine source objects via tavonel-cdr-synthetic and writes immutable PDFs.
GPU OCR candidate processing
Foundation RunPod GPU OCR is qualified by the 2026-08-29 browser-to-ocr.json full-sequence evidence. Scale-to-zero and candidate-only review remain enforced.
Candidate promotion into a live world
Promotion is always an explicit human decision.
Intake, content disarm and GPU OCR opened only after the recorded 2026-08-29 full-sequence qualification. Promotion remains closed by design: a candidate becomes active only after an authenticated human approval.