Highlights:

S3-only pipeline: workers read from object storage and write results back

No permanent local disk persistence on workers

Source files deleted immediately after processing

Converted files expire after 24 hours by default

Operational logs kept up to 30 days (metadata only, no file contents)

I’m posting this because security questions come up every time someone evaluates file-processing infrastructure. Feedback welcome — especially on what you’d want clarified for a vendor security review.