Browser-only tools
Files used by browser-only tools should remain on the user's device and clear from the workspace when the user resets the tool.
Server-processed tools
Temporary uploads and generated downloads should be deleted within one hour, with signed URLs that are not publicly exposed.
AI tools
Future AI processing should use clear labeling, quota controls, and a no-training-on-documents policy.