MyPDF is operated by Wackywow.com LLC, in Maryland, USA. This page describes how MyPDF handles documents and account data in production. It is not a certification and not a substitute for your own security review. Last updated October 10, 2026.
What we certify — and what we do not
We have not completed a SOC 2, ISO 27001, or HIPAA audit, and we do not sign Business Associate Agreements. Do not use MyPDF as the system of record for regulated health, payment-card, or government-classified files. If that changes, we will say so here.
Files
- Browser tools (merge, rotate, organize, extract, grayscale, OCR, self-sign) process the file on your device.
- Website convert, compress, protect, and unlock keep working files on the instance disk while Ghostscript, qpdf, or LibreOffice runs. Those scratch files are deleted after 60 minutes.
- Finished convert/compress downloads, signature-request PDFs, and async API compress files go through an object store (local temp by default; Azure Blob when configured). Convert and async outputs are deleted after about 60 minutes. Signature-request PDFs are kept until the link expires (7 days by default), then deleted.
- We do not use document contents for ads or model training.
Accounts and keys
- Passwords are stored as bcrypt hashes, not plaintext.
- API keys use a
pdf_live_prefix. We store only a SHA-256 hash. The full key is shown once. - Webhook deliveries are signed with HMAC-SHA256. The signing secret is shown once. See the developer docs to verify
PDFTools-Signature. - Google and Microsoft sign-in are optional and only enabled when those OAuth credentials are configured.
Payments and email
Subscriptions and credits go through Stripe. Card data stays with Stripe. Transactional email (resets, invites, signed- document notices) is sent only if Amazon SES or SMTP is configured.
Analytics
MyPDF does not show ads. Google Analytics runs if a measurement ID is configured. It records page views plus funnel events (activation, jobs, paywall, signup, checkout, API keys) without emails, file names, or document contents.
Your responsibilities
You decide whether a file is appropriate to process here. Use a paid plan and HTTPS, keep API keys on your server, and verify webhook signatures. For privacy rights and retention details see the Privacy Policy. Email [email protected] for security reports and compliance questions.