Transport protection
Production traffic is intended to run over HTTPS. Authenticated requests use bearer tokens, and secrets must be stored outside committed config files.
Security starts with less retention
Docora keeps the launch architecture small, explicit, and easy to audit: web app, gateway, Postgres, Redis, and short-lived file storage.
Short-lived files
The product target is automatic deletion after 2 hours for uploads and results, reducing the amount of user content kept by the service.
Operational boundaries
The Docora gateway is separate from AuSync services, which keeps auth, quota, billing, and PDF processing isolated for this product.
Security should stay invisible
Run the PDF task without extra steps.