Audit every sensitive action.
Every interaction with sensitive material becomes an attributable, auditable event.
Case study — secure document vault The document stays protected.
The document stays protected.
The work keeps moving.
A secure, auditable vault for sensitive documents — designed to turn protected evidence into the minimum operational signal an authorised team needs to act.
Independent document systemEncrypted evidenceControlled processingAudit trail
Sensitive documents cannot be ordinary uploads.
The brief was to build an independent system for receiving and managing highly sensitive documents. The existing workflow could move information, but it could not provide the control, privacy, or accountability this kind of material requires.
- Control Sensitive material stays inside a bounded system.
- Privacy Raw document contents do not spread through operations.
- Accountability Every handling action can be traced.
How the vault keeps sensitive documents protected.
Confirm before you commit.
A request is confirmed before commit, leaving a durable handling record.
Encrypt at rest and in transit.
Each stored record has a distinct key, and every transfer stays encrypted.
Process inside the boundary.
OCR and QR detection run in controlled infrastructure; outputs and logs stay inside.
A document enters protected. It stays that way.
From encrypted intake to durable commit, controlled processing, and expiry, each stage preserves the boundary.
Protection persists across every stage.
Entry and commit
- 01Encrypt before intake.
A document is protected before it enters the system.
- 02Commit under a durable key.
At commit, it is re-encrypted under its own stored-record key.
Inside the protected boundary
- 03Process inside the boundary.
Document processing runs without sending sensitive material outside the system.
- 04Expire working copies.
Temporary intake copies are removed once their purpose is complete.
A protected document can be accessed—but never silently.
Access is an authorised action, not a background permission.
An authorised person requests access to protected material.
The action is confirmed before material is made available.
The approved action and actor become part of the audit trail.
Access is a sensitive operation. So it leaves a trace.
Two readers, working inside one boundary.
QR detection and OCR each see documents differently. Together, they create a bounded operational signal without exporting sensitive material.
Protected evidence stays within the system.
Encrypted evidence enters QR + OCR processing.
It is made available only to the controlled processing system.
Independent processing paths
Try multiple ways to read the pattern.
OpenCV applies contrast enhancement, denoising, scaling, and multiple detection paths within a time budget.
Evidence boundary
Strongest usable signal.
Signals are evaluated as evidence tiers, not an identity claim.
Try multiple ways to read the text.
Grayscale, contrast, and threshold normalisation passes are paired with reading modes and ranked for usable structure.
Minimum necessary output
Status, not raw content.
The authorised workflow receives the status needed to act. Extracted fields—such as a name, date, and reference value—remain protected inside the system.
Give operations the signal, not the document.
Raw document contents stay in the vault. Authorised teams receive only the minimum status needed to identify a submission that needs attention and follow up appropriately.
This keeps operational work moving without turning the wider stack into another store of sensitive evidence.
The document and its extracted fields stay here.
- Original document evidence
- Extracted structured fields
- Protected processing results
Minimum necessary signal
A status that tells the team what needs attention.
Submission needs follow-up
Example signals
QR-based number identification failed
OCR number detection passed; checksum failed
Teams can use the status to request a new upload or begin another approved follow-up, without copying sensitive evidence into the wider operational stack.
A pragmatic stack for a strict boundary.
Each layer is chosen to make sensitive-document handling inspectable, controlled, and maintainable.
Deployment coordination
One monorepo. One Wrangler configuration.
The application, data, storage, Durable Objects, workflows, queues, and containerised processing are defined and deployed as one coordinated system.
SvelteKit
Admin and operations interface.
Cloudflare R2
Separated transient and durable object storage.
Cloudflare D1
Transactional records and bounded operational state.
Durable Objects + workflows + queues
Durable processing, retries, state, and expiry handling.
Cloudflare Containers + FastAPI
Controlled Python service boundary for document analysis.
OpenCV + Tesseract
QR detection and OCR without exporting documents.