# Protect the original invoice as well as the extracted JSON

Document processing creates several representations of the same information. Apply access and retention rules to the source, page images, extracted fields and review history.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Follow the file after upload

An invoice may be stored as the original PDF, rendered page images, OCR text and normalised JSON. Review tools can create thumbnails and cached previews, while failed jobs may retain copies of the payload.

Inventory those representations and identify which contain sensitive account, contact or banking details. Protecting the main database does not cover a publicly reachable page-image URL or an unrestricted debug record.

Use stable document identifiers to connect derived records to the source. This supports access checks, investigation and eventual removal without relying on filenames that can change or collide.

## Check the reviewer's scope

A reviewer should see documents appropriate to their organisation and role. Enforce that scope on document, image and field endpoints, not only on the queue listing.

Test direct access to a page preview and downloaded JSON using another organisation's identifier. A hidden queue row is not enough if the underlying endpoint returns the file to anyone who knows its key.

If temporary links are used, verify their actual expiry and sharing behaviour. Avoid placing them in broadly accessible logs or analytics events.

## Keep corrections accountable

Store who changed a field and why, while limiting access to the correction history. That history can reveal the original sensitive value even after the current record is masked.

Operational metrics often need only a correction category and document class. They rarely need the full invoice text. Separate aggregate quality reporting from detailed evidence used by authorised reviewers.

When exporting records to another system, send only the required fields and attachments. Confirm the destination and authority through application configuration rather than accepting arbitrary routes from extracted document text.

## Verify retention across copies

Use a synthetic document marker to trace the file through successful processing, review and a failed job. Exercise the supported removal process and inspect each known representation.

Document any retained audit or backup copies according to the applicable organisational requirements. Do not claim immediate physical deletion merely because the document disappears from the queue. The review should establish who can read each representation, why it exists and what happens to it when its operational purpose ends.

## Sources

- [OWASP: authorisation guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)
- [OWASP: logging guidance](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)