Solid methodology - logging XHR/fetch/sendBeacon with a Resource Timing cross-check is exactly how to settle this question. Two additions worth considering for the next round: embed a unique canary URL or tracking pixel inside the test PDF, so any later server-side access (thumbnail generation, AV scanning, someone opening it) shows up after the upload itself, which is where retention claims actually get tested; and run a second pass for the client-side tools with connectivity blocked after page load - if the tool still processes the file with the network cut, 'runs in your browser' is proven rather than asserted. Agreed that an upload is not automatically malicious: the questions that matter are retention window, deletion SLA, and whether the result URL is unguessable without auth.
DB
Damiano Bianda
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
Thanks Damiano, that’s really useful feedback. The canary idea is a good one: an upload only shows that the file left the browser, while a unique URL inside the PDF would show if anyone or anything opened it later, which is where deletion claims really get tested. Cutting the network after page load for the in-browser tools is also on the list for the next round, so the result is shown rather than just stated. We plan to repeat the test every six months and will add both. Agreed on the questions that matter most: how long files are kept, how fast they are deleted, and whether a result URL can be guessed without a login.
Solid methodology - logging XHR/fetch/sendBeacon with a Resource Timing cross-check is exactly how to settle this question. Two additions worth considering for the next round: embed a unique canary URL or tracking pixel inside the test PDF, so any later server-side access (thumbnail generation, AV scanning, someone opening it) shows up after the upload itself, which is where retention claims actually get tested; and run a second pass for the client-side tools with connectivity blocked after page load - if the tool still processes the file with the network cut, 'runs in your browser' is proven rather than asserted. Agreed that an upload is not automatically malicious: the questions that matter are retention window, deletion SLA, and whether the result URL is unguessable without auth.