How the platform protects and removes your documents

A document you put in a Library is encrypted before it reaches permanent storage, checked before any agent can read it, and removed on a schedule you can plan around. The platform records some permission decisions; it does not record who read a document.

What protects a document at rest

The platform encrypts the permanent content it keeps for every document you upload:

• The file itself.
• The text and pictures it extracts from that file.
• The search data built from that content.

Encryption is AES-256-GCM, and the platform applies it before the bytes reach object storage. Every copy the platform creates from this permanent content stays in that encrypted form, including a temporary copy it makes to serve a read. Duale AI holds the keys and the storage provider does not, so access to the stored bytes alone does not open a document. Key custody and rotation need a security review. Request that review through the Trust Center.

You configure nothing. There is no setting to turn this on, and no per-Library choice to make.

A document delete does not remove every platform copy at once. The upload path leaves a separate copy whose clock starts at upload, not at deletion. Data protection states its protection and lifetime, lists every other surviving copy, and covers the same at-rest boundary across the platform.

Encryption is not what separates one tenant from another. The grant is, and Access and isolation owns that boundary. The Trust Center adds the hosting and subprocessor context for a procurement review.

What the platform checks before an agent can read a document

Integrity and malware checks must pass before the platform extracts any text. A document that fails either one never becomes readable. It stays in a listing with its failed state, but the platform reads no text from it, so no search, match, or read reaches its content.

• Integrity. The platform recomputes the file’s SHA-256 and its size, then compares both against what the upload declared. A mismatch fails the document.
• Malware. The platform scans every uploaded file. A signature match fails the document, and the platform keeps the scanned file with that failed document instead of extracting it.

A failed document reports its own code. Errors lists every code with the recovery for it.

Deleting the failed document is what removes the file the platform kept. Investigate the file at its source first, then delete the document.

An upload session belongs to one caller in one tenant

The platform binds each upload session to the identity that opened it and to the tenant it was opened in. A caller who presents that upload identifier under another identity is refused, and so is a caller who presents it in another tenant. A leaked upload identifier is therefore not a path into your documents.

The part upload URLs a session returns are signed and time-limited. Treat each one as a credential for its lifetime, and keep it out of application logs. Data protection gives that lifetime.

What happens when you delete a document

A document delete is reversible for 30 days. The document becomes eligible for permanent removal after that window, and physical reclamation runs asynchronously.

Deleting a document moves it into Recently deleted, where it stays for 30 days. Inside that window, a caller with library:write on that Library can restore the document. The platform then re-indexes it. It returns through the same queued and processing states as a new upload before an agent reads it again.

After the window the platform starts permanent removal. Removal therefore completes after the window closes rather than on its last day. Nothing makes that document unrecoverable inside the window unless you delete its Library.

Deleting the Library that holds a document makes that document unrecoverable, even inside its restore window. A Library delete is therefore the one operation that can destroy a document you were still entitled to restore.

Two consequences belong in a data-protection review:

• Deleting one document does not remove content that another live document in your tenant still uses. That content goes once no live document refers to it. No content is ever shared between tenants.
• Deleting a Library makes all its documents unrecoverable at once. Its record and grants become eligible for removal after 24 hours. A periodic process reclaims the record, grants, and content that no live document uses, so do not treat 24 hours as an exact deadline.

Plan an erasure deadline from the delete, not from the window

Count the 30 days from the moment you delete the document, and add margin for the removal that follows the window. If a contractual erasure deadline is shorter than that, delete the document early enough that the window closes before the deadline arrives.

Data protection gives the full copy inventory and each clock, and Limits holds the Library window table. Manage a Library shows the calls that delete and restore.

What the record shows, and what it does not

Use recorded permission decisions as evidence of permission checks, not as a complete access history.

For a recorded decision, the resource lets you ask which identity was permitted to reach a Library, and when. It does not prove which identity read a document, and cached repeats do not create another decision record.

Write your own record when an action happens if you must give evidence of it later. Record who shared a Library and with whom. Also record which document an agent read for a given answer. Evidence and audit lists what the platform records, what it leaves out, and what you record yourself. The governance page answers the same question for a security or procurement review.