# DocuChan: product and browser PDF tools reference

## Product identity

The DocuChan core is built by Masterbek. This Japan-localized edition is presented as DocuChan, Powered by Bekito. It combines encrypted link-based file delivery, WebRTC device-to-device transfer, peer-to-peer document collaboration, a direct clipboard tool, and local PDF utilities. The canonical site is https://docuchan.bekito.co.jp/.

## 日本向けエディション / Japan-localized edition

製品名は DocuChan（ドキュちゃん）です。日本向けエディションは Powered by Bekito と表示し、Masterbek remains the builder of the DocuChan core. 日本国内でのデータ保管、認証取得、法令適合、サービスレベルを保証するものではありません。ファイルの暗号文は日本国外のオブジェクトストレージに保存される場合があります。Bekito版では現在、決済機能を提供していません。See https://docuchan.bekito.co.jp/business-sharing-guide?lang=ja for sender and recipient guidance and https://docuchan.bekito.co.jp/agent-resources?lang=ja for canonical discovery resources.


## Rooms collaboration boundary

Rooms at https://docuchan.bekito.co.jp/rooms provides real-time rich-text and Markdown collaboration, comments, embedded raster images, collaborator presence, and local Mermaid rendering. Document state is represented as a Yjs collaborative document and moves over WebRTC data channels between participant browsers. DocuChan's application server brokers only short-lived peer presence and bounded SDP/ICE signaling records; it is not a document relay and stores no server-side document copy.

Each room has a high-entropy public room identifier and a separate 256-bit room secret in the invite URL fragment. The fragment is captured and removed from the visible URL before client hydration, is not included in HTTP requests, and is never accepted by the signaling API. Peers authenticate the encrypted application protocol with the shared room secret and encrypt messages with AES-256-GCM session keys derived through HKDF. This protects document contents from the signaling service. The complete invite link is a bearer decryption capability, but a locked room also requires explicit approval from its online host before signaling and synchronization can begin.

Room documents may persist as plaintext in that browser's IndexedDB so an accidental tab closure can be recovered. Recent-room metadata in local storage includes the fragment secret and display name. For the creator it can also include a separate random host capability used only for lock and admission controls; invite/resume URLs never include that value, and the server stores only its SHA-256 hash. The signaling database retains short-lived lock state, hashed peer capabilities, admission status, self-asserted names, and timestamps in addition to presence and SDP/ICE. The Rooms lobby lets the user remove one local recovery record or clear all known Rooms databases and recovery keys. DocuChan has no server-side backup or document history and cannot recover a lost room or host capability. Other participants can retain, screenshot, copy, or export content they are authorized to view.

Rooms uses public STUN to discover a direct path and the deployment's short-lived TURN credentials when direct ICE negotiation cannot cross a restrictive network. The Rooms application layer remains AES-256-GCM encrypted over TURN, so a relay can observe network metadata and encrypted traffic volume but cannot read document content or room keys. Direct participants can observe one another's network addresses. Collaborator names are self-asserted and are not proof of legal identity. The browser client is served by DocuChan and has not yet received an independent security audit.

## Browser-only PDF processing boundary

On routes under https://docuchan.bekito.co.jp/tools, PDF parsing, thumbnail rendering, page editing, privacy inspection, sanitization, compression, and export run in dedicated browser workers. The selected source PDF and generated PDF bytes stay in that browser context unless the user explicitly downloads them or chooses Send or Beam. The tools enclave does not load analytics, account requests, or the service worker. Closing the tab releases the in-memory workspace.

The browser tools enforce conservative safety limits, including bounded input size, aggregate workspace size, page count, rendered pixels, and raster work. Encrypted PDFs can be opened with a password that remains in the browser. Certified PDFs and unsupported signature structures fail closed when their editing policy cannot be preserved safely.

## PDF organizer

The organizer at https://docuchan.bekito.co.jp/tools/pdf accepts one or more PDFs. It can merge documents, reorder pages, rotate pages, duplicate pages, delete pages, insert blank pages, add another PDF, and export selected pages or the whole result. It preserves a working copy and does not overwrite the user's original file.

The organizer checks the current working copy for supported privacy findings. The compact status can be expanded to review or edit supported metadata, remove it, or create a stronger sanitized output. Download, Send, and Beam receive the exact finalized copy selected by the user.

## PDF compression

The compressor at https://docuchan.bekito.co.jp/tools/compress-pdf supports a lossless structural mode and raster modes with adjustable quality and DPI. It can search for a result near an optional target size and reports the exact generated byte size before the user saves or forwards it. Raster compression can remove searchable text, links, forms, accessibility structure, and valid signatures because pages are rebuilt as images. Lossless mode is the appropriate choice when document structure matters.

The compressor checks supported privacy findings before generating its preview. If the user edits or removes metadata or requests a sanitized copy, that change is applied first and a new compression preview is generated from the changed copy. The displayed size and the Download, Send, or Beam artifact therefore refer to the same finalized compressed bytes.

## PDF Privacy Check

The checker at https://docuchan.bekito.co.jp/tools/privacy-check reports supported standard document properties, creation and modification dates, creator and producer values, language hints, document identifiers, bounded XMP information, annotations, embedded files, JavaScript and automatic actions, external actions, forms, XFA, signature structures, and optional layers.

Metadata-only editing changes the selected metadata fields but intentionally leaves other reported findings untouched. Full sanitization removes the supported and reported document-level data categories and creates a separate copy. The structural sanitizer can remove annotations, form controls, links, outlines, and accessibility structure while preserving base page content and image quality. A visible-pages-only raster cleanup is available only when the document has no annotations that could be hiding content.

The Privacy Check does not inspect visible text, OCR text, invisible page text, images, or private information visually present on a page. It is not a redaction detector. Unapplied redaction annotations block sanitization because removing their appearance could expose underlying content. Users should visually compare sanitized output before sharing.

## Send and Beam handoff

After a PDF result is generated, the user may download it, send it through DocuChan, or stage it for Beam. Same-origin Send and Beam handoff uses a one-shot in-memory browser channel and a fresh tab. It does not base64-encode the PDF or persist plaintext to Cache Storage or IndexedDB. Send then performs its normal browser encryption and ciphertext upload only after the user continues. Beam does not transmit until the user selects a peer.

## Encrypted file delivery boundary

For normal Send, file contents are encrypted in the browser with AES-256-GCM before upload. The decryption key is placed in the URL fragment, which browsers do not send in HTTP requests. The application server handles transfer metadata and storage authorization; encrypted file bytes travel directly between the browser and object storage. A recipient still needs the complete link and any optional password.

Beam uses WebRTC and an authenticated key agreement. Users compare a short authentication code to detect a signaling intermediary attempting a man-in-the-middle attack. Network conditions may require a relay when configured; the security page documents the current deployment boundary.

## Canonical public resources

- Product: https://docuchan.bekito.co.jp/
- PDF tools: https://docuchan.bekito.co.jp/tools
- Security: https://docuchan.bekito.co.jp/security
- Privacy: https://docuchan.bekito.co.jp/privacy
- Terms: https://docuchan.bekito.co.jp/terms
- Sitemap: https://docuchan.bekito.co.jp/sitemap.xml
- Agent resources: https://docuchan.bekito.co.jp/agent-resources
- Machine-readable facts: https://docuchan.bekito.co.jp/product.json

## Agent and automation boundary

The LLM text files and product facts JSON are informational, read-only references. They do not provide an autonomous-agent upload tool, MCP server, file-transfer API, or permission to access private transfer links. Sending, receiving, Beam, Clipboard, Rooms, and PDF operations remain interactive browser workflows. Never place a private DocuChan URL, fragment key, password, user file, or room invitation into a third-party model unless the user has independently chosen to disclose it.