Skip to main content
TribunoTribuno

Private documents in Matter Review

Understand PDF security, extraction, redaction approval, privacy receipts, deletion and recovery before adding a document.

Matter Review

In this article

What you can add

Use Add document in Evidence to upload a valid PDF of no more than 20 MB and 100 pages, or paste a bounded extract. Add only material needed for the research task. Tribuno is not a document archive.

  • Password-protected PDFs are not accepted and Tribuno never requests or stores a PDF password.
  • Scanned PDFs are supported through OCR when usable searchable text is not available.
  • A pasted extract creates pseudonymised evidence without storing an original PDF.

What happens to a PDF

The original is uploaded into encrypted AWS storage and must pass a security scan before processing. Tribuno first attempts native searchable-text extraction. Amazon Textract receives the original PDF only when OCR is needed for scanned or unsuitable pages.

  1. 1The browser uploads the PDF to a private, time-limited storage location.
  2. 2The file is security-scanned before the extraction worker or Textract may read it.
  3. 3Native extraction is tried first; OCR is used only where needed.
  4. 4Tribuno prepares one pseudonymised page at a time for your review.
  5. 5No searchable chunks or Evidence Register items are created until you approve the pseudonymised pages.

Redaction review and OpenAI

Review every page, especially pages marked for attention. Correct the pseudonymised text where necessary before approval. Automated pseudonymisation can miss context, so approval remains a human decision.

  • OpenAI does not receive the original PDF or unapproved extraction.
  • Approved pseudonymised text may be used for memo interpretation where that workflow is enabled.
  • Private Matter Review embeddings are not sent to an external embedding provider.

Privacy receipt

Open Privacy receipt on a document to see the security-scan state, extraction method, redaction approval, OpenAI boundary, original-file expiry and confirmed deletion evidence. The receipt reports recorded events; it is not a certificate that every personal detail was detected.

  • Confirmed deleted means Tribuno recorded successful early removal of the original object.
  • An expiry date means the seven-day automatic lifecycle remains the fallback ceiling.
  • Pasted text reports that no original PDF was stored.

Deletion and recovery

Tribuno attempts to delete the original PDF immediately after redaction approval. If that attempt cannot be confirmed, the encrypted original remains subject to the seven-day automatic lifecycle. Deleting the document, profile or workspace removes any remaining active original sooner.

  • For a password-protected file, save an unlocked copy using software you trust, then replace the PDF.
  • For an invalid, oversized or over-100-page file, create a valid smaller replacement.
  • For interrupted scanning or extraction, upload again to start a fresh security pipeline.
  • Where offered, paste only the necessary searchable extract instead of the whole file.
  • A delayed or failed item can also be deleted or sent to contextual support without including document text.