This page describes how MyPDF handles documents and account data in production. It is not a certification and not a substitute for your own security review. Last updated August 31, 2026.
What we certify — and what we do not
We have not completed a SOC 2, ISO 27001, or HIPAA audit, and we do not sign Business Associate Agreements. Do not use MyPDF as the system of record for regulated health, payment-card, or government-classified files. If that changes, we will say so here.
Files
- Browser tools (merge, rotate, organize, extract, grayscale, OCR, self-sign) process the file on your device.
- Website convert, compress, protect, and unlock keep working files on the instance disk while Ghostscript, qpdf, or LibreOffice runs. Those scratch files are deleted after 60 minutes.
- Finished convert/compress downloads, signature-request PDFs, and async API compress files go through an object store (local temp by default; Azure Blob when configured). Convert and async outputs are deleted after about 60 minutes. Signature-request PDFs are kept until the link expires (7 days by default), then deleted.
- We do not use document contents for ads or model training.
Accounts and keys
- Passwords are stored as bcrypt hashes, not plaintext.
- API keys use a
pdf_live_prefix. We store only a SHA-256 hash. The full key is shown once. - Webhook deliveries are signed with HMAC-SHA256. The signing secret is shown once. See the developer docs to verify
PDFTools-Signature. - Google and Microsoft sign-in are optional and only enabled when those OAuth credentials are configured.
Payments and email
Subscriptions and credits go through Stripe. Card data stays with Stripe. Transactional email (resets, invites, signed- document notices) is sent only if Amazon SES or SMTP is configured.
Ads and analytics
Free users may see Google AdSense on landing pages, not on upload screens. Google Analytics runs if a measurement ID is configured. It records page views plus funnel events (activation, jobs, paywall, signup, checkout, API keys) without emails, file names, or document contents. Paid accounts do not see those ads.
Your responsibilities
You decide whether a file is appropriate to process here. Use a paid plan and HTTPS, keep API keys on your server, and verify webhook signatures. For privacy rights and retention details see the Privacy Policy. Email hello@mypdf.io for security reports.