Document parsing security starts before the parser runs

Treat every source as untrusted

File extension and MIME type can disagree. Archives and complex formats can expand unexpectedly. Parsers have large dependency surfaces. Validate declared size, enforce actual object size, cap decompression and page work, apply deadlines, and run risky components in isolated processes with minimum privileges.

Never place user-controlled filenames directly into storage paths or shell commands. Use generated object identifiers and retain the display name only as metadata.

Control network and provider egress

URL import and webhooks create server-side request forgery risk. Permit only HTTPS, validate DNS and redirects, reject private and special-use addresses, limit redirects and response size, and enforce tenant-specific host allowlists. Revalidate at each redirect.

External OCR and model calls should be explicit capabilities. Keep secrets server-side, record provider attempts without request bodies, and block calls when durable cost accounting is unavailable.

• No browser access to global service credentials.
• Named and scoped tenant keys stored only as hashes.
• Same-origin and CSRF protection for cookie-authenticated portal mutations.
• Provider request logging disabled when document bodies are sensitive.

Separate retention from job status

A succeeded or canceled job says what happened operationally; it does not define whether source and artifacts should remain. Store retention timestamps and expose a separate authorized purge action. Delete product-owned raw sources and derived artifacts only when no retained job still references shared content-addressed results.

Logs and analytics should not become a hidden copy of document contents. Record identifiers, paths, outcomes, sizes, timings, and error classes while excluding raw text, secrets, full referrer URLs, and IP addresses from product analytics.

Review the complete boundary

Threat modeling should include upload, URL import, storage, queue messages, container runtime, models, provider gateways, result access, webhooks, portal sessions, and deletion. Test tenant isolation on every read and mutation path.

Security controls reduce risk but do not create compliance claims by themselves. Data processing agreements, jurisdiction, customer configuration, and organizational procedures remain separate decisions.