PDFLean
Security & Trust Center

Security at PDFLean: Local-First & Short Retention

We recognize the extreme confidentiality of legal contracts, financial filings, and medical records. PDFLean is architected on privacy-first principles and strict security isolation.

SOC 2 practices aligned (not certified) GDPR-ready · DPA available TLS 1.3 in transit Local-first · short retention

Executive Summary:

Core everyday tools (merge, split, compress, convert, watermark) execute inside your browser sandbox and are not uploaded by default. Optional cloud-accelerated tasks use TLS 1.3 in transit; cloud files are kept by plan (7 days on Free, 30 days on paid plans), task records up to 7 days. Files are never used for ads or AI training.

01. Client-Side Processing for Local Tools

Tools labeled Local run with client-side JavaScript and WebAssembly (for example pdf.js, pdf-lib, and WASM image codecs) inside your browser. Those files are not uploaded to us. Once the page has loaded, local tools keep working if your connection drops.

02. Local Zero-Upload & Short Cloud Retention

Local by default, cloud only when you choose it:

  • Local tools: files are not uploaded to us; memory is released when the tab closes. No server-side persistence.
  • Optional cloud tasks: cloud files are kept by plan (7 days on Free, 30 days on paid plans), task records up to 7 days. Use “Delete now” in your portal anytime.

03. Encryption in Transit & at Rest

HSTS and TLS 1.3 in transit; AES-256 at rest for temporary cloud objects with lifecycle auto-deletion. Deletion means server-side object removal and expiry cleanup; we do not claim cryptographic shredding.

04. Least-Privilege Access & Audit Logs

Role-based access control with least privilege on internal endpoints. File content is used only to complete your requested task — never for ads or model training. Key operational actions write audit logs.

05. Standard DPA for GDPR Compliance

For institutional teams subject to EU GDPR, UK GDPR, or California CCPA regulations, we provide our standard Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs). Request countersignature via support@pdflean.com.

06. Responsible Vulnerability Disclosure Program

We value the global security research community. If you identify a potential security issue, please submit proof-of-concept details to our security team. We commit to zero legal action against researchers acting in good faith with coordinated disclosure.

07. Sub-processors & Data Residency

We keep our sub-processor list short and publish it here:

  • Cloudflare — hosting, compute, object storage, and network security (global edge).
  • Stripe — payment processing; we never store full card numbers.
  • Resend — transactional email (account and billing notifications).
  • DeepSeek — optional AI summarisation / translation, invoked server-side only when you use an AI feature (data is transferred outside the EEA/UK; see the subprocessors page for safeguards).

We do not use your documents for advertising or to train AI models. For teams that require EU data residency or a signed sub-processor list, contact support@pdflean.com.