Security Practices

Everything Is PDF reduces exposure by keeping supported work in the browser and limiting server processing to operations that need it.

Validation and limits

Upload paths check expected file types, file sizes, and parseable PDF or Office structures before processing. Server endpoints validate request sizes. Office conversion enforces a conversion timeout and concurrency limit, while AI endpoints add request and rate controls. Password operations validate their inputs and clean up temporary files, but do not currently use the same explicit timeout, concurrency, and rate controls.

Temporary isolation and cleanup

Office conversion and password operations use isolated temporary working directories. Temporary files are removed after both successful and failed operations. Files are not added to a permanent document library.

Passwords and API keys

PDF passwords are used only for the requested protect or unlock operation and are not intentionally logged or retained. Optional AI API keys remain on the server and are never sent to the browser.

Logging

Application logs are limited to operational request details such as route, status, and timing. Document contents, passwords, AI prompts, and AI responses are excluded from intentional logging.

Responsible use

No web tool removes every risk. Keep originals, use trusted devices, avoid unknown browser extensions, and do not process a document if the tool-specific privacy boundary is unsuitable for it.