Command applies four layers of protection to document content: an automatic PII security scan on every conversion, a retention sweep that deletes original binaries once Markdown exists, optional organization-level Markdown encryption, and two-factor verification on downloads.
In this section
- Understand how PII scanning masks content and where findings live.
- Configure how long original files are retained before the sweep.
- Decide whether to enable Markdown encryption and how to backfill.
- Manage the download verification window and read download audit logs.
What's inside
- 01
Security Scan (PII & secrets)
Every conversion to Markdown fans out a PII scan that runs global rules plus project overrides. Destructive rules (SSN, credit card, API keys, email, phone by default) overwrite the stored Markdown with a masked copy and clear the raw version, so the sanitized text is the only version ever served to agents, downloads, and previews. Heuristic rules (generic_secret, shannon_high, digits_only_strict) only record findings.
- 02
Managing scan rules and findings
Open Security Scan from the project menu. Global rules are read-only defaults; project admins add, edit, or disable project-scoped overrides, each with a regex or heuristic, a severity, and a Destructive flag. The file drawer's PII panel lists findings, with a Scan History dropdown covering the last 25 runs, and /projects/:id/security-scan/runs shows every run with status, timings, and counts. Rescan all files or Rescan flagged backfills older content; org admins have a resumable PII Backfill panel.
- 03
Original file retention
Once a file has Markdown and a completed PII scan, the original binary is swept from Storage after the organization's retention window — default 30 days, any positive number of days, 0 for immediate, or Keep forever. An hourly sweep deletes the object, stamps the deletion time, and logs the run; the Markdown is never touched. The Download original button then shows an 'Original deleted (retention)' badge, and storage totals still reflect the original size.
- 04
Document (Markdown) encryption
An opt-in second layer on top of infrastructure encryption: document Markdown is stored as AES-256-GCM ciphertext using a unique 256-bit data key per organization, wrapped by a master key. Keys are never exposed to the browser or to agents, and decryption happens server-side at the read chokepoint. Enable it in Organization Settings — owners and admins must acknowledge that lost keys mean unrecoverable content — then run Backfill existing markdown, a resumable batched job.
- 05
Two-factor verification for downloads
On by default for every organization. A download request without a valid verification window is refused and the app prompts for a 6-digit emailed code, opening a time-boxed window (default 15 minutes, configurable 1–120). Codes expire after 10 minutes, lock out after 5 failed attempts, and are rate-limited per user and per IP. It covers original downloads, bulk signed-URL and source ZIPs, Markdown downloads, project and folder Markdown ZIPs, merged Markdown, and exports — single-file in-app previews stay ungated.
- 06
Download audit logging
Every download is recorded server-side with the acting user, file, and timestamp — including signed-URL and bulk ZIP paths. View them from Project Activity or the organization activity trail.
Trade-offs to plan for
PII masking is destructive with no Markdown-level undo — recovery means re-converting from the original binary, which the retention sweep may have already removed. And with Markdown encryption on, SQL keyword search cannot match encrypted document bodies; file name, metadata, and label search are unaffected.