Library security: encryption and deletion

This page follows a Library document from upload to removal: how Duale AI protects it, the checks before it becomes readable, the upload session, the delete and restore lifecycle, and what Duale AI records. Duale AI records some permission decisions; it does not record who read a document.

The Python SDK and the Dashboard encrypt Library requests end to end to Duale AI, in addition to HTTPS. File parts go over HTTPS to signed upload URLs. End-to-end encryption explains that boundary. Data protection covers encryption at rest across the Platform and every copy that outlives a delete.

How a stored document is protected

Duale AI encrypts what it keeps for every document you upload:

• The file itself.
• The text and pictures extracted from that file.
• The search data built from that content.

Encryption is AES-256-GCM. Duale AI manages the keys, and the storage provider does not hold them, so access to the stored files alone does not open a document. You configure nothing: there is no setting to turn this on, and no per-Library choice to make.

Two copies sit outside that encryption for a limited time:

• The file you upload first lands in the temporary upload area, without this encryption. Duale AI removes it a limited time after the upload, whether or not you delete the document.
• To process a document, answer a read, or send an image to a model, Duale AI works on a short-lived decrypted working copy.

Key custody and rotation detail is available through a security review. Request that review through the Trust Center.

Encryption is not what separates one Tenant from another. Access control is, and Access and isolation owns that boundary. The Trust Center adds the hosting and subprocessor context for a procurement review.

What Duale AI checks before a document is readable

Duale AI checks every uploaded file before it extracts any text:

• Integrity. The stored file must match the size and checksum declared at upload. A mismatch fails the document.
• Malware. Duale AI scans every uploaded file. A signature match fails the document.

A document that fails either check never becomes readable. It stays in a listing with its failed status, and no search, match, or read reaches its content. A failed document usually reports its own code, but the detailed failure can be absent. SDK errors lists the known codes and the recovery for each one.

Duale AI keeps the file with the failed document until you delete the document. Investigate the file at its source first, then delete the document.

An upload session belongs to one caller in one tenant

Duale AI binds each upload session to the identity that opened it and to the tenant it was opened in. A caller who presents that upload identifier under another identity is refused, and so is a caller who presents it in another tenant. A leaked upload identifier is therefore not a path into your documents.

The part upload URLs a session returns are signed and time-limited. Treat each one as a credential for its lifetime, and keep it out of application logs. Limits gives that lifetime.

What happens when you delete a document or a Library

The life of a Library documentYou upload a file and it is queued, then processed. Processing checks the file's integrity, scans it for malware, and extracts its content. A document that passes becomes ready, and Tasks can search it. A document that fails stays listed as failed and is never readable. Deleting a ready document moves it to Recently deleted for 30 days, where you can restore it; a restored document is processed again. After the window the document is removed. Deleting the whole Library makes every document unrecoverable at once, including those in Recently deleted.

Deleting a document moves it into Recently deleted for 30 days. During that window, a caller with library:write on the Library can restore it, and Duale AI processes it again through the queued and processing statuses before Tasks can read it. After the window, Duale AI removes the document permanently. That removal has no fixed completion time, so 30 days is not an exact removal deadline.

Deleting a Library makes all its documents unrecoverable at once, including those still inside their restore window. Its record becomes eligible for removal after 24 hours, and that removal has no fixed completion time either. Grants on the Library’s path remain and reach a later Library at that path. Access and isolation explains which Grants to revoke before you delete.

A person deletes a whole Library in the Dashboard. Deleting a Library that is already deleted gives the same result as the first delete. If the delete meets a rename of the same Library, Duale AI refuses it and deletes nothing: open the Library again, then repeat the delete. A temporary failure reported after documents were removed does not undo the deletion: repeat the delete of the same Library, and report a persistent failure to support with its request_id.

When the same file was uploaded as several documents in your Tenant, its content goes only after every one of those documents is deleted. No content is ever shared between Tenants.

Plan an erasure deadline from the delete, not from the window

Count the 30 days from the moment you delete the document, and add margin for the removal that follows the window. If a contractual erasure deadline is shorter than that, delete the document early enough that the window closes before the deadline arrives.

The copy in the temporary upload area is removed a limited time after the upload, whatever you delete, and Task history can quote a document. Data protection lists the copies that outlive a delete, and Limits holds the Library window table. Manage libraries shows the calls that delete and restore.

What the record shows, and what it does not

Use recorded permission decisions as evidence of permission checks, not as a complete access history.

For a recorded decision, the resource lets you ask which identity was permitted to reach a Library, and when. It does not prove which identity read a document, and not every decision is recorded.

Write your own record when an action happens if you must give evidence of it later. Record who shared a Library and with whom. Also record which document supported a given answer. Evidence and audit lists what Duale AI records, how often it records a decision, what it leaves out, and what you record yourself. The Trust Center answers the same question for a security or procurement review.