Security

1. Files stay on your device

All file tools, including compression, OCR and conversions, run in your browser (JavaScript and WebAssembly). The file is not sent to a server, so no one on our side can access it. You can check this yourself: open your browser's developer tools (F12), the "Network" tab, and process a file — you will not see the file being uploaded. Only text for the AI features and a page address for URL to PDF reach the server.

2. Encrypted connection

The site works only over HTTPS. The HSTS header (with an entry on the browsers' preload list) makes the browser always connect securely, even on the first visit.

3. Protection in the browser

• A Content Security Policy limits where the site may load scripts from and what it may connect to: our domain and the services named in it (Google sign-in, Dropbox, Microsoft and, after consent, Google Analytics).
• The site cannot be embedded in another site (X-Frame-Options: DENY, frame-ancestors) — protecting you from clickjacking.
• Permissions-Policy blocks access to the camera, microphone, location, USB and payments.
• X-Content-Type-Options and Referrer-Policy limit file-type guessing and the passing on of page addresses.

4. Server protection

• API requests are accepted only from our own site (Origin and Referer checks — CSRF protection).
• Request limits: 30 a minute per IP address for the API, 15 a day for the AI features, 30 per 10 minutes for URL to PDF; a request size limit of 100 MB.
• URL to PDF rejects addresses of private and local networks and of the server's cloud services, and the address checked is the same one the server connects to (protection against SSRF and DNS rebinding).
• API input is checked on the server (text length, allowed translation languages).

5. AI features

We send the AI only the text extracted from the file and your question — without your IP address or browser details, through our server and its API key (you need no key of your own). Every request requires a provider that, according to OpenRouter, does not store data beyond the request and does not train models on it; if none is available, the request is not carried out.

6. No accounts or profiles

We require no registration or sign-in, store no passwords and build no user profiles. Passwords for protecting and unlocking PDFs and certificates for signing are used only in your browser.

7. Dependencies

We keep libraries up to date and check them for known vulnerabilities with npm audit and a test that reports every new high or critical advisory in the dependencies the site uses.

8. Reporting a vulnerability

If you find a security flaw, write to kontakt@optimapdf.com. We commit to:

• confirm receipt within 24 hours,
• analyse it and ship a fix within 14 days (depending on severity),
• tell you what we did,
• take no legal action against people who report vulnerabilities in good faith.

9. Certifications

OptimaPDF holds no ISO 27001 or SOC 2 certification of its own. Our hosting provider, Vercel, is ISO 27001:2022 certified and has a SOC 2 Type 2 report. Since files never reach our server, there are no files "at rest" on our side to encrypt.

10. Digital signatures and eIDAS

The "Sign PDF" tool creates a PAdES digital signature with your own certificate (.p12/.pfx) — entirely in the browser; neither the file nor the certificate is sent anywhere. It is a real cryptographic signature, but not automatically a qualified electronic signature (QES) under the eIDAS Regulation (EU 910/2014): QES status depends on whether the certificate was issued by a qualified trust service provider and the key is on a qualified device.