Data handling

Security and retention

• API credentials are stored as SHA-256 hashes and are shown only once during registration.
• Customer objects are private, encrypted at rest, and never placed in a public bucket.
• Input files are deleted after processing, whether conversion succeeds or fails.
• Successful outputs expire after approximately 30 minutes; a one-day S3 lifecycle rule is the safety net.
• Macros are not executed. XLS VBA preservation is disabled.
• Download URLs are short-lived and should be treated as secrets.
• Tenant ownership is checked for every task query.

Customer responsibilities

• Keep API keys in a secrets manager and rotate them if exposure is suspected.
• Do not log bearer credentials or download URLs.
• Do not upload files unless you are authorized to process their contents.
• Validate representative outputs before relying on conversion in a critical workflow.

Reporting

Report security concerns to support@corenovacloud.com. Include a request or task ID, timestamp, and description, but do not attach customer documents.