docs
View as Markdown

Ephemeral processing

Emboss can process a form without keeping the document afterward. Ephemeral processing is a retention mode: once a form goes quiet, its documents are deleted, not just marked for later cleanup.

The switch

Every account has a retention default, set on the account page: ephemeral or account_default. The create and with-context calls also take an optional retention body field with the same two values, so a single request can override the account's default for that one form. Leave it out and the account's own default applies. The two values are ephemeral and account_default; the field lives on POST /forms, POST /forms/with-context, POST /forms/{form_id}/with-context, POST /forms/prepare, POST /forms/{form_id}/prepare, and POST /forms/{form_id}/fill-batch.

The MCP tools and A2A skills of the same shape, create_form, fill_form, fill_form_from_context, prepare_form and fill_batch on MCP, and their A2A counterparts, take the same retention argument with the same two values.

The pay-per-call API is always ephemeral

The pay-per-call API has no account behind it, so every request to it always runs under ephemeral processing. There is nothing to opt out of and no field to set: an anonymous caller's documents are deleted on the same schedule as an account holder's ephemeral form.

A price that is never paid expires an hour after the request, and the documents sent with it are deleted at the next cleanup, within ten minutes after that. Once a job is paid for, its status and result stay available for 24 hours from the price, so a lost answer can be fetched again; the job's files follow the window below.

The window

Ephemeral processing: source and output documents are deleted 60 to 70 minutes after the last activity on a form. A background sweep runs every ten minutes, so a form's documents are gone somewhere inside that window after the last activity on it, not on the stroke of the sentence's own number.

Outputs of a free PDF utility follow the same window, measured from creation rather than last activity, for every caller.

The xfa_data export a fill of an XFA form returns follows the filled PDF's own retention: it is deleted on the same sweep, and answers 410 once the filled PDF does. The xfa_render page drawn from a dynamic XFA form's template follows the form's own retention, with its fillable copy and thumbnail.

What the value check sends

After a fill, Emboss asks a decision model (TypeSafe's Jev, reached through OpenRouter, listed on the subprocessor page) whether each written value belongs in its box, and, when your documents offered two competing values for one box, which one belongs. For each box it sends the form's title, the box's name and kind, the words printed beside a box on the form, the value written, and the names and values of the boxes on the same row. For a competing pair it also sends, for each value, the name of the document and the page it came from, up to 200 characters on each side of the quote, and the names of the other boxes on that page. It sends no whole document, never the form image, and never anything that identifies your account.

The answers are probabilities. A doubt appears as a note on the receipt; the value is written as filled. Retention at the providers is governed by their policies: OpenRouter's privacy policy and TypeSafe's privacy policy. Turning the check off is an operator setting; the fill behaves as before when it is off.

What a 410 means

Once a form has been swept, its document routes, the flat upload, the fillable copy, the thumbnail and the filled output, answer 410 Gone. The receipt is the exception: it keeps answering 200 with the values redacted out. The problem detail on the 410 response is the sentence itself: a swept form's document routes answer HTTP 410 with the retention sentence as the problem detail. A 410 is not an error to retry: it means the window closed and the documents are gone.

What a redacted receipt still proves

The receipt survives a sweep even though the documents behind it do not. What is deleted: the uploaded form, the fillable copy and the thumbnail, the supporting documents, every filled output and batch output, and the session's values, the proposal's evidence and the receipt's values themselves. What is kept: the blank form's layout, the execution receipt's record (ids, file sizes and fingerprints, timestamps, and the retention block that recorded which policy applied and when it was swept), a record of each file without the file itself, payment and usage records, and security logs. A redacted receipt proves what happened and when, and against which files, by their sizes and fingerprints, without holding onto a single label or value.

Where to read more

  • Security lists exactly what is kept and what is deleted, and how documents are handled in transit and at rest.
  • Subprocessors describes the providers a request passes through while it runs.
  • Read a filled form back on an account stores nothing at all, not even for the retention window: there is no document to sweep. The pay-per-call read holds the file only until it is paid for, and keeps the values it read with the job for 24 hours.