Security in 30 seconds
Most tools run entirely in your browser via WebAssembly, so your file is not uploaded to a server. Saving files to your account and using the developer API are the exceptions — those do send files to our servers, encrypted in transit and deleted on a schedule tied to your plan.
1. Processing runs in your browser by default
For the tools on this site, PDF operations run on-device using WebAssembly (WASM) builds of established, open-source PDF libraries loaded directly in your browser. For those tools there is no upload step and no server-side processing — your file is read, transformed, and written back out locally on your device.
2. The engines behind local processing
We ship a mix of WebAssembly engines and JavaScript libraries and load them on demand in the browser. The WebAssembly builds are qpdf (qpdf.wasm) for structural operations such as merging, splitting, and page manipulation; our own PDF engine, written in Go and compiled to WebAssembly, for merge, split, rotate, arrange, and document info; and LibreOffice (libreoffice-wasm) for office-format conversions. Rendering, rasterisation, and text extraction run on pdf.js, and watermarks, page numbers, and image-to-PDF conversion run on pdf-lib — both plain JavaScript libraries, not WebAssembly. Everything on this list runs locally in your browser, not on our servers.
3. When files do leave your device
Local, in-browser processing is the default, not a universal guarantee for every feature. If you create an account and use a feature such as saving files to your dashboard, or if you use our developer API, your files are transmitted to our servers so that feature can work — a server has to receive the file to store it against your account or to return an API result.
4. Encryption & retention
Files that are sent to our servers (for account features or the API) are encrypted in transit and are deleted from our servers on a schedule tied to your plan — see the retention windows listed on our Pricing page. Full details on what we collect and how long we keep it are in our Privacy Policy, linked below.
5. Certifications & audits
We do not currently hold or claim formal third-party security certifications such as SOC 2 or ISO 27001. If you need more detail than this page provides for a compliance review, contact us and we’ll do our best to help.
6. Related policies
This page is a plain-language summary, not a substitute for our legal documents. See our Privacy Policy for what data we collect and how we use it, and our Terms of Service for the rules governing use of the Service.
Have a question we didn’t answer?
Reach out and we’ll walk you through how a specific tool or feature handles your files.
Contact us