Privacy ·
Why uploading corporate files to cloud utilities leaks telemetry
When an employee uploads a contract to a free merge site, the request is telemetry: source IP, filename, bytes, timestamps, and whatever the vendor derives. DLP tools that watch Google Drive do not see a random converter. Client-side merge never creates that event.
Request anatomy
multipart/form-data with a file field is a copy. CDNs log URL and size. WAFs may inspect bodies. Object storage keys often include original names. Support staff can be a human processor.
Derived data
Thumbnails, OCR indexes, “improve our models” clauses, and virus-scan copies. Even a black-box “redaction” product may have received the unredacted original first. That is the redaction seed post.
Corporate DLP mismatch
CASB products catalog sanctioned SaaS. A weekend PDF merger is not on the list. Browser-only tools keep the file inside the managed endpoint if the endpoint is the laptop.
The client-side path
FileReader or blob.arrayBuffer, pdf-lib or Papaparse, Blob download. Zero POST of the payload. Merge and split in tab memory is the PDF instance of this rule.
Incident narrative
A “quick convert” of a customer list CSV is a disclosure. Treat online utilities as vendors with no DPA unless you have one. Default to local.
Frequently asked questions
What logs does a typical convert API keep?
At minimum: load balancer, WAF, application, and object-store access logs. Many also keep the object until a lifecycle rule fires — if it does.
Is a privacy policy enough?
It is a contract, not a control. You cannot audit their disk. You can audit your Network tab.
What about “files encrypted in transit”?
TLS protects the path to the vendor, not the vendor. The plaintext exists on their side after TLS termination.