Solid methodology - logging XHR/fetch/sendBeacon with a Resource Timing cross-check is exactly how to settle this question. Two additions worth considering for the next round: embed a unique canary URL or tracking pixel inside the test PDF, so any later server-side access (thumbnail generation, AV scanning, someone opening it) shows up after the upload itself, which is where retention claims actually get tested; and run a second pass for the client-side tools with connectivity blocked after page load - if the tool still processes the file with the network cut, 'runs in your browser' is proven rather than asserted. Agreed that an upload is not automatically malicious: the questions that matter are retention window, deletion SLA, and whether the result URL is unguessable without auth.