How the service is built, in enough detail to judge whether it suits the documents you are thinking of uploading.
In transit
The site is served over HTTPS only. Requests to the insecure port are redirected, and the site sends HSTS headers so browsers refuse to downgrade the connection.
Your file is encrypted between your browser and our server for both the upload and the download.
While being processed
The file is written to a temporary working directory that is not served to the public web. It is reachable only through the tool you started, using an unguessable identifier generated for that request.
Identifiers are validated before use and resolved paths are checked to sit inside the working directory, so a crafted identifier cannot be used to reach anything else on the server.
Processing runs as an unprivileged user in an isolated container, not as an administrator.
Afterwards
A background task deletes uploads and results older than 2 hours. Deletion is judged by the file's own age, so it happens even if the process that created it has since restarted.
There is no backup, archive or long-term copy. Once the cleanup has run, the file no longer exists on the server.
PDF passwords and encryption
Protect PDF encrypts a document with AES-256, the current standard for document encryption, and lets you decide separately whether printing and copying remain permitted.
The password you type is used to encrypt the file and is never stored. We cannot recover it, and neither can anyone else -- if you lose it, the document cannot be opened.
Unlock PDF removes protection only when you supply the correct password. It does not crack, guess or bypass encryption.
What we deliberately do not do
No document is opened or reviewed by a person. There is no moderation queue.
No file is forwarded to a third-party service for conversion.
No file contents are logged, indexed or retained after deletion.
Reporting a vulnerability
If you find a security issue, please tell us before telling anyone else and give us a reasonable window to fix it. Contact details are on the contact page. We will not pursue anyone who reports a genuine issue in good faith and does not access or destroy other people's data.