Security copy is usually a list of words. This one is a list of mechanisms, including the ones that are missing, because a viewer you cannot describe accurately is a viewer you cannot assess.

1. The file is temporary, by design

Upload a document and it is held only for the session that is reading it. Close the viewer and it is deleted from the server. Nothing accumulates, because there is no account for it to accumulate under and no library to browse.

That is the strongest claim on this page, and it is deliberately narrow: no retention means no long-term exposure, not that the document was never read by a machine you do not own.

2. Nothing installs

No application, no plugin, no extension. A browser and a URL. That removes a whole class of risk — installers, auto-updaters, and desktop software that reads more of your disk than it needs — and it means the security posture of the page is the security posture of your browser.

3. HTTPS in transit, server-side rendering

Uploads and page requests run over HTTPS, which protects the file on the way. Be exact about the rest: rendering happens on our servers, so the server reads the document while it draws it. There is no end-to-end encryption, and there cannot be while a server is doing the work.

If a document may not be read by a third party at all, no hosted viewer qualifies, this one included. The Doconut .NET SDK is the same rendering engine as a component inside your own application, where the file never leaves your network.

4. What this site does not have

Worth stating outright, because the absence changes how you should use it:

No accounts, so no per-user permissions, no sharing links, and no audit trail to hand a reviewer.
No annotations or comments. Annotation is a plugin for the SDK, not a feature here.
No certification. No ISO 27001, no SOC 2, no HIPAA attestation. If a policy requires one, this tool cannot satisfy it.
No batch upload, which also means no queue of your documents sitting anywhere.

5. Same behaviour on every device

Desktop, tablet or phone: the rendering happens on the server, so the device changes nothing about how the file is handled or how long it survives.

Conclusion

The model is simple enough to hold in your head: HTTPS in, rendered on a server, deleted with the session, no account, no certificate. For everyday documents that is a reasonable trade. For documents that may not leave your own infrastructure, run the renderer inside it — that is what the SDK is for.