Before uploading a document anywhere, the question worth answering is a narrow one: what does this service actually do with the file, and for how long. Here is our answer, including the parts that are not flattering.
Zero-Retention Policy
Your file is rendered in a temporary session tied to your browser, and deleted from our servers when that session ends. There is no account on Doconut.app, so there is nothing for a file to be filed under, no library it can reappear in, and nothing to come back for later.
Not keeping something is the strongest guarantee available about it. It is also the only one we are making about storage — there is no encrypted archive here, because there is no archive.
Encryption in Transit
The upload runs over HTTPS, which protects the file in transit between your browser and our servers — the part of the journey a shared or public network can see.
After that the file is on our servers, because a hosted viewer has to receive a document in order to render it. Any online tool claiming otherwise is either purely client-side or describing itself inaccurately.
Trust and Compliance
This is where we should be blunt, because the category is full of vendors who are not.
Doconut.app holds no certifications. No ISO 27001, no SOC 2, no HIPAA attestation, no PCI DSS assessment. We will not sign a Data Processing Agreement or a Business Associate Agreement with you, because it is a free public service with no contract behind it.
That matters more than any encryption claim. If you handle personal data under GDPR or PHI under HIPAA, moving a file to a processor with no agreement in place is a problem at the moment of upload, whether or not anything is ever breached. Minimising a data footprint is a good practice; it is not a legal basis.
So: for an ordinary document you need to read once, a viewer that keeps nothing is a sensible choice — and safer than downloading the file onto a machine you do not control. For anything under a compliance obligation, keep the rendering inside your own network. That is what the Doconut SDK is for: the same engine, installed in your environment, making no calls out to us.