Security & Compliance

Architecture: privacy & security by design

PDFER runs every document operation client-side. Files are not uploaded, not stored, and not logged. This data-minimisation by design dramatically reduces the attack surface: there is no document database to breach and no file storage to leak.

Technical & organisational measures

• No data at rest. Files are held in browser memory only and actively zero-wiped when you leave a tool page; closing the tab discards everything.
• No data exfiltration. A Content-Security-Policy with connect-src 'self' blocks the app from sending data to any external origin.
• Encryption in transit. All traffic is served over HTTPS/TLS, with HSTS (Strict-Transport-Security) enforced.
• Hardened HTTP headers. Content-Security-Policy, X-Frame-Options / frame-ancestors (anti-clickjacking), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.
• No tracking.No advertising, no behavioural profiling, and no cross-site trackers. We measure only cookieless, privacy-friendly aggregate traffic and performance (Vercel Web Analytics & Speed Insights); see the Privacy Policy for detail.
• Hardened hosting.Served on Vercel's infrastructure, which maintains independent security attestations (e.g. SOC 2 Type II).
• Responsible disclosure. A security.txt provides a contact for reporting vulnerabilities.

GDPR

PDFER is designed to comply with the GDPR through data minimisation: we do not collect, process, or store personal data or document content beyond the minimal technical metadata our host needs to serve the site. See the Privacy Policy for the full detail, including lawful bases and your data-subject rights.

ISO/IEC 27001

Our security practices are aligned with the control objectives of ISO/IEC 27001 — including information-security policy, access control, cryptography, operations security, communications security, and supplier relationships — and PDFER runs on infrastructure that holds recognised security certifications.

To be precise about what this means: ISO/IEC 27001 certification is granted only by an accredited third-party auditor of an organisation's information-security management system. PDFER is not itself certified; we implement the standard's controls where they apply to a serverless, client-side product and will pursue formal certification if and when the organisation's scale warrants it. We will never display a certification we do not hold.

Israel — Protection of Privacy Law (Amendment 13)

PDFER is designed to align with Israel's Protection of Privacy Law (as amended by Amendment 13, in force since August 2025) and the Protection of Privacy (Data Security) Regulations, 5777–2017. Because files are processed client-side and never stored, we maintain no database of personal information — so database-registration and mandatory Data Protection Officer obligations are not triggered — and our controls (encryption in transit, no data at rest, access control, and a CSP that blocks external data transfer) are built to meet the regulations' “reasonable security” standard. See the Privacy Policy for data-subject rights under Israeli law.

Reporting a vulnerability

If you believe you have found a security issue, please email security@pdfer.cc or use the contact listed in our security.txt. We appreciate responsible disclosure.