Skip to content
PDFBetter
Upload

Trust

Security and data handling

This page describes how PDFBetter actually handles your files today. Where we don't have a certification or control yet, we say so rather than imply it.

  1. In your browserNever uploaded

    Merge, split, rotate, images ↔ PDF and more run on your device.

  2. Your private workspaceEncrypted at rest

    Edits, fills and signatures are stored so you can come back; reachable only through short-lived signed links.

  3. Our conversion serversOutput to your storage

    Office conversion, compression, OCR, redaction and scan cleanup run in isolated containers.

  4. AI providersNot used for training

    AI features send document text (or page images for scan restoration) — only what the feature needs.

Every tool page says which of these applies before you start.

Three places a file can be processed

Every tool page states which of these applies before you start:

  • In your browser. Merge, split, rotate, extract, organize, images ↔ PDF, PDF to text, watermark, page numbers and password protection run on your device. The file is never uploaded to us.
  • Your private workspace. When you edit, fill or sign, the original file and your changes are stored so you can come back. Exports are generated on our servers after an account and allowance check.
  • Our conversion servers. Office conversions, compression, OCR, redaction and scan cleanup run in isolated containers on Cloudflare. Inputs and outputs are written to your private storage area.

Storage and access

  • Files are stored in Cloudflare R2, which encrypts objects at rest. Connections use TLS.
  • Files are only reachable through signed links that expire within minutes. There are no public bucket URLs.
  • Each document is checked against your account on every request. Document IDs are random, and requests for documents you don't own return “not found”.
  • Share links use long random tokens, can expire, can require a password, and can be revoked at any time.
  • App pages, signing pages, shared links and public forms are excluded from search engines.

Retention and deletion

  • Drafts created without an account are deleted 1 hour after they were created, together with their files.
  • Files uploaded only to run a tool are deleted after 24 hours.
  • When you delete a document it leaves your dashboard immediately and its files are purged within 30 days.
  • Deleting your account removes your documents, signatures, templates, forms and responses. Evidence of completed signature requests (the sealed PDF, certificate of completion and audit trail) is kept for 7 years after completion so everyone who signed can still prove the agreement.

E-signature evidence

Every signer signs with their own cryptographic key. When a signer opens a request, their browser generates an ECDSA P-256 key that never leaves the device and signs a statement binding the document's SHA-256 fingerprint to exactly what they entered; PDFBetter's certificate authority certifies that key, and its fingerprint is on the certificate of completion. Every step — sent, viewed, consented, signed, declined — is written to an append-only audit log where each entry includes the hash of the one before it, so later tampering is detectable. The completed PDF and the certificate are digitally sealed with a PAdES signature and, when the time-stamping authority is reachable, independently time-stamped under RFC 3161; the PDF carries the signing evidence inside it, so changing one byte makes PDF readers flag the file. Signature requests are designed to the technical requirements of an advanced electronic signature (eIDAS art. 26): a unique key per signer, under their sole control, linked to the document so any change is detectable. Signers are identified by email (and an optional emailed code), not by ID documents or SMS, and the signatures are not qualified electronic signatures. The seal certificate is issued by PDFBetter's own certificate authority, which is not yet on Adobe's trust list, so Acrobat shows the seal's identity as not verified unless you trust that certificate; change detection works either way. See e-signature legality for what the law generally requires.

Redaction versus covering

Whiteout and blackout only cover content visually; the text underneath remains in the file. Redaction is different: PDFBetter rebuilds each affected page as an image with the marked areas removed, deletes annotations, form fields and metadata, and then re-extracts text to confirm nothing remains in the redacted areas.

AI processing

AI features send the text of your document to OpenAI's API; scan restoration sends page images to fal.ai. We send only what the feature needs and we don't use your documents to train models. Document text is treated as data, never as instructions, which limits prompt-injection from document content.

Accounts

  • Passwords are hashed by our authentication library; we never see or store them in plain text.
  • Sign-in with Google and one-time email links are available.
  • Payment details are handled by Stripe; we don't store card numbers.

What we don't claim yet

PDFBetter has not completed a SOC 2 or ISO 27001 audit, is not HIPAA compliant and does not sign Business Associate Agreements. If your work requires those, don't upload regulated data until we publish otherwise on this page.