Umitake Document Generator for Kintone — Data Handling

The most important fact: when you produce a PDF from a DOCX or XLSX template, the merged document passes through our conversion server in the United States.

Every other output — DOCX, XLSX, and PDFs produced from HTML templates — is generated entirely in your browser and never touches our servers.

For the CDN and license verification common to every product, see the shared infrastructure document.

This document describes what is implemented, not what is intended. We make no deletion promises that no code enforces.

1. Our Role

When you use PDF conversion, we act as a processor of your business data, with you — the organisation using kintone — as the controller.

When you do not use PDF conversion (DOCX / XLSX output, or PDF from an HTML template), we receive no business data at all.

2. Data Flow

Your kintone
  └──> Your browser … record values merged into the template
         ├── DOCX / XLSX output      → downloaded directly (never reaches us)
         ├── PDF from HTML template  → rendered in the browser (never reaches us)
         └── PDF from DOCX / XLSX    → convert-us.umitake.com
                                         (Cloudflare → Fly.io, Virginia, USA)
                                         → PDF returned → browser

What is sent to the conversion service is the finished document, with your record values already merged in. It may therefore contain:

• kintone field values (customer names, addresses, amounts, staff names, and so on)
• Subtable rows and values pulled from lookups or related-record lists
• Images from attachment fields embedded in the template

Bulk output such as label printing sends data for many records in a single request.

3. What We Store

Nothing. The conversion server has no database and no object storage.

Stated as facts verifiable in the configuration:

• The conversion server has no persistent volume attached, so no file survives a restart.
• It has no database, no object storage, and no cache of any kind.
• Conversion is performed by the upstream engine (Gotenberg), and the LibreOffice process is recycled every 10 requests.

Please also read the note in §6.

4. What Transits but Is Not Stored

There are facts here that do not favour us, and we state them too.

• Deletion after conversion depends on the behaviour of the upstream conversion engine (Gotenberg). We have written no deletion code, no test, and no continuous verification of it. What we can demonstrate is only what §3 says: that no persistent volume and no database exist.
• The conversion endpoint is unauthenticated. It requires no license key and no token. Its only access control checks that the request originates from *.kintone.com / *.cybozu.com — but that is a browser-side control and does not prevent server-to-server calls. The per-request size limit is 100MB.
• kintone page URLs appear in the access logs. Browsers automatically attach a Referer header, which takes the form https://<your-subdomain>.kintone.com/k/<appId>/show#record=<recordId>. It is not masked. Document contents are not logged.

Facts that do favour us, equally verifiable in the code:

• Your filenames are never sent. The uploaded file is always named document.docx or document.xlsx.
• The request carries no license key, domain, user ID, or authentication header. The conversion server cannot identify you from the request itself.

5. Subprocessors and Locations

Uptime monitoring converts a synthetic document of our own every 10 minutes. It never uses your data.

Where the processing happens

PDF conversion is performed in the United States (Virginia). We do not offer a Japan region.

If processing within Japan is a requirement, you can use the product without PDF conversion — DOCX / XLSX output, or PDF from an HTML template — and no data will pass through our servers.

6. Retention Periods

7. On Cancellation and Disconnection

There is no data of yours on the conversion server to delete at cancellation, because documents are not stored.

Generated files live in your kintone or on your own devices, and we never touch them.

License records are handled as described in §7 of the shared infrastructure document.

8. What We Cannot See

• We cannot retrieve a document you converted in the past. It was never stored.
• We cannot tell from a conversion request which customer sent it, because the request carries no identifying information — though the subdomain is visible in the access-log Referer (see §4).
• We cannot see your kintone records. The conversion server never connects to kintone.

9. Your Responsibilities

• Deciding whether to use PDF conversion. If your requirements prevent business data leaving the country or passing through a third-party server, choose DOCX / XLSX output or PDF from an HTML template; neither touches our servers.
• Template design. Limiting the fields merged into a template limits what is sent to the conversion server.
• kintone permissions. The product reads records using the permissions of the person operating it, so what can be output follows your kintone permission design.

10. Contact

For questions about this document or help completing a security questionnaire:

Umitake Email: [email protected]

Related: Shared infrastructure · Privacy Policy · Terms of Service