deposit: PDFs private by default