Data handling
Security, isolation, and temporary file retention
The service is designed as a short-lived conversion boundary. It accepts a legacy Office file, produces a validated OOXML result, and removes both artifacts on a defined schedule.
Protection controls
| Area | Behavior |
|---|---|
| Transport | Requests use HTTPS on the fixed api.corenovacloud.com domain. |
| Credentials | API keys are displayed once and stored by CoreNova only as SHA-256 hashes. They are separate from AWS access keys. |
| Object storage | Source and output objects are private, encrypted at rest, and blocked from public access. |
| Tenant isolation | Every task query checks credential ownership; another tenant cannot retrieve the task by guessing its ID. |
| Downloads | A successful task returns a short-lived presigned URL. Treat that URL as a temporary secret. |
| Active content | Macros are never executed. XLS VBA preservation is disabled. |
Retention lifecycle
- Upload: the private source object exists only while the task is processed.
- Processing complete: the input is deleted whether conversion succeeds or fails.
- Result window: a successful output is available for approximately 30 minutes; status queries can issue a fresh five-minute download URL during that window.
- Safety net: a one-day S3 lifecycle rule removes any object missed by normal cleanup. Lifecycle deletion timing is controlled by Amazon S3 and is not instantaneous.
Do not use the API as storage. Download successful results promptly and move them into your own controlled retention system.
Customer responsibilities
- Store the CoreNova API key in AWS Secrets Manager or an equivalent secrets service.
- Do not expose keys in browser code, source control, logs, support tickets, or screenshots.
- Do not log presigned download URLs.
- Upload only content you are authorized to process.
- Apply your own data-classification, regional, legal, and retention requirements before production use.
- Validate representative outputs before a critical migration or AI ingestion workflow.
Security reporting and key rotation
Report a suspected key exposure or security issue to [email protected]. Include the AWS account ID, request or task ID, timestamp, and description. Do not attach customer documents, credentials, or download URLs. Support can revoke the old credential and guide re-registration.