Our Automatic File-Retention Guarantee
Fileora is engineered around automated ephemeral storage. Uploaded and converted files exist only long enough for you to download them. Original uploads are unlinked immediately once conversion completes. Successfully converted output files are retained for 60 minutes so you can download or retry. An automated daemon sweeps and deletes expired files every 10 minutes, and you can click the red "Delete" button on your download card to purge your file immediately on demand.
The 5 Stages of the File Lifecycle
Step-by-step technical breakdown of what happens to your document from upload to permanent destruction.
Upload & Streaming Security
Files are transmitted exclusively over encrypted HTTPS (TLS). As bytes arrive at the Node.js backend, our gateway verifies file magic bytes, MIME signatures, and size constraints (3 MB individual file limit, 5 MB batch limit). If an upload exceeds limits or presents malformed structures, the connection is terminated immediately and memory is freed.
Conversion & Immediate Original File Unlinking
Conversions execute in an isolated environment using open-source conversion engines (LibreOffice headless, Sharp, PDF.js, pdf-lib). Source files are stored temporarily on ephemeral disk space with non-enumerable, cryptographically random UUID identifiers. As soon as conversion succeeds or fails, original uploaded input files are immediately unlinked (fs.unlinkSync) from the server.
Temporary Storage in Cloudflare R2
The converted output file is pushed directly to our private Cloudflare R2 object storage bucket (fileconverter-temp) using authenticated S3-compatible APIs. The bucket is completely private: public read access is disabled, directory indexing is blocked, and files are encrypted at rest using industry-standard AES-256 (Server-Side Encryption).
60-Minute Dedicated Download Window
Your browser receives a dedicated download URL formatted with your unique job UUID and cryptographically random 256-bit token. You can navigate, refresh the page, or download the converted file across multiple devices during the 60-minute retention window. Constant-time token verification prevents timing attacks and brute-force guessing.
Permanent Deletion (Immediate or Scheduled Sweep)
Your file is permanently destroyed via one of two mechanisms:
- Immediate Manual Deletion: Choosing the red delete (trash) button next to a file on your download page and confirming triggers an immediate
DELETE /api/jobs/:jobIdrequest, purging the object from Cloudflare R2 and deleting the database record within seconds. - Automated Background Sweeps: A background daemon on our server runs every 10 minutes. It identifies all completed jobs older than 60 minutes and failed jobs older than 15 minutes, issues S3-compatible DeleteObject commands to Cloudflare R2, and clears the metadata.
- Worst-Case Cleanup Delay: With a 60-minute retention period and a 10-minute sweep interval, the maximum delay before an expired file is deleted is 70 minutes.
Retention Targets & Technical Matrix
Verified architectural specifications of our storage infrastructure:
Unlinked from disk immediately upon conversion completion (< 1s delay)
S3 DeleteObject from Cloudflare R2 via 10-minute automated sweeps (max 70m delay)
Purged from database and storage during 10-minute sweep (max 25m delay)
Server-side expiry validation returns HTTP 410 Gone (instant expiration)
Periodic filesystem scan deletes files older than 15 min (max 25m delay)
Storage objects with no live record are purged once they are older than the retention period (about 70 minutes at most)
User clicks "Delete" on download page; triggers instant S3 delete (< 2s)
| Data Category | Configured Retention Target | Destruction Mechanism | Max Delay |
|---|---|---|---|
| Original Uploaded Files | Immediate (0 min) | Unlinked from disk immediately upon conversion completion | < 1 second |
| Converted Output Files (R2) | 60 minutes | S3 DeleteObject from Cloudflare R2 via 10-minute automated sweeps | 70 minutes |
| Failed or Abandoned Jobs | 15 minutes | Purged from database and storage during 10-minute sweep | 25 minutes |
| Download Authorization Tokens | 60 minutes | Server-side expiry validation returns HTTP 410 Gone | Exact (instant) |
| Local Intermediate Temp Files | 15 minutes | Periodic filesystem scan deletes files older than 15 min | 25 minutes |
| Orphaned R2 Objects | Older than the retention period (60 min) | Each sweep lists stored objects, and deletes those older than the retention period that the job database confirms have no live record. If the database cannot be reached, nothing is deleted and the sweep is retried | About 70 minutes |
| Manual User Deletion | On demand (instant) | User clicks "Delete" on download page; triggers instant S3 delete | < 2 seconds |
Cloudflare R2 Lifecycle Rules (Secondary Safeguard)
Cloudflare R2 provides bucket lifecycle rules that delete objects based on whole-day intervals (minimum 1 day = 24 hours).
While R2 lifecycle rules run asynchronously once daily and cannot enforce our precise 60-minute user download window, a scoped rule on prefix converted/ serves as an ideal secondary fail-safe. If the server were ever to experience prolonged downtime, a configured lifecycle rule can ensure no object survives longer than its configured period (minimum one day).
How You Can Verify File Deletion
You can independently verify that our deletion mechanisms function as promised:
- Immediate Deletion Test: Convert a sample test file. On the download card, click "Delete". Now copy the download URL and paste it into a private/incognito browser window. The server will return
HTTP 404 / 410 File Not Found or Expired. - 60-Minute Expiration Test: Bookmark any download link and return after 60 minutes. The server will return
HTTP 410 Expired, and the background daemon will purge the underlying R2 object.
Questions Regarding File Retention
If you have questions about our retention architecture or wish to request data erasure, please email: