Thin edge workers
Cloudflare Workers verify webhooks, store metadata, and enqueue jobs quickly. CPU-heavy conversion stays off the edge.
Temporary file storage
Source and result files are stored in Cloudflare R2 under temporary keys and cleaned up by retention policy.
Deterministic conversion
LibreOffice, Ghostscript, qpdf, Poppler, ImageMagick, and Tesseract perform the conversion work on Linode.
AI with boundaries
OpenRouter is used for intent parsing, response wording, and voice transcription. Raw document contents are not sent to AI by default.
Signed internal calls
Worker-to-service requests use shared secrets so conversion and AI endpoints can reject unauthenticated traffic.
Operational audit trail
Jobs, state changes, AI requests, and failures are recorded for debugging and admin review.
Security posture for beta
The beta is intentionally narrow: Telegram first, temporary storage, constrained conversion actions, and admin visibility into failures. As WhatsApp and LINE roll out, the same boundaries apply to webhook verification, media downloads, queue dispatch, and result delivery.