Security

1. Client-side processing in the browser

Most OptimaPDF operate on a zero-trust architecture — your file never leaves your device. We use WebAssembly and JavaScript to process PDF files directly in your browser. This means that even we, as service operators, have no access to your files. This applies to: merge, split, rotate, watermark, page-numbers, crop-pdf, edit-pdf, sign-pdf, redact-pdf, flatten-pdf, delete-pages, extract-pages, reorder-pages, add-page, metadata, pdf-to-svg, pdf-to-epub, pdf-to-txt, fill-form, pdf-to-images, to-pdfa, compare-pdf, unlock-pdf, and protect-pdf.

2. TLS/SSL encryption

All communication between your browser and our server is encrypted using TLS 1.3 (Transport Layer Security). We use an SSL certificate issued by a trusted certificate authority. This means that data transmitted over the internet is unreadable to third parties. You can verify the certificate validity by clicking the padlock icon in your browser's address bar.

3. Content Security Policy (CSP)

We enforce a strict Content Security Policy (CSP) that restricts the execution of scripts from untrusted sources. CSP prevents Cross-Site Scripting (XSS) attacks, code injection, and data theft. Our CSP policy is regularly audited and updated.

4. RAM-only processing

For tools requiring server-side processing (compression, OCR, format conversions), files are processed exclusively in the server's RAM. Files are not written to the hard drive, not copied to backups, and not replicated. Once the operation completes, the file is immediately removed from memory. Maximum server retention time: a few seconds.

5. File verification

• Magic bytes verification — before processing, we verify that the uploaded file is actually a PDF by analyzing its header (%PDF). This prevents file-type spoofing attacks.
• File size limit — maximum upload size is 100 MB. This protects against both server overload and potential DoS attacks.
• Integrity check — we verify that the file is not corrupted before starting processing.

6. Attack protection

• CSRF protection — we use anti-CSRF tokens and Origin/Referer header verification to prevent Cross-Site Request Forgery attacks.
• Rate limiting — we limit requests from a single IP address, protecting against brute-force and DoS attacks.
• HTTP Security Headers — we apply X-Content-Type-Options (nosniff), X-Frame-Options (DENY), Strict-Transport-Security (HSTS), and Referrer-Policy headers.
• Input validation — all input data is validated on both client and server side, preventing injection attacks.

7. Zero data storage

We do not store your files or personal data on the server. We do not require registration, login, or email address to use the tools. We do not create user profiles or track your activity between visits.

8. AI feature security

AI features use the external OpenRouter API. Your API key is stored exclusively in your browser's localStorage — we have no access to it. Text sent to OpenRouter is limited to content extracted from the PDF. We do not send user-identifying data, IP address, or browser information. OpenRouter uses TLS encryption and does not use submitted content for AI model training.

9. Dependency security

We regularly update all libraries and dependencies used in the project. We use automatic vulnerability scanning tools (npm audit, Snyk). All critical vulnerabilities are patched within 48 hours of CVE publication.

10. Vulnerability disclosure

If you discover a security vulnerability in OptimaPDF, please responsibly disclose it by emailing kontakt@optimapdf.com. We commit to:

• Acknowledging receipt within 24 hours.
• Performing analysis and taking corrective action within 14 days (depending on severity).
• Informing the reporter about actions taken.
• Not pursuing legal action against those who responsibly disclose vulnerabilities.

11. File transmission security

In the rare cases where a file must be sent to the server (server-side tools), transmission occurs over encrypted HTTPS using TLS 1.3. The file is transmitted in memory (streaming) without temporary disk storage. After receiving the response, the file is immediately removed from server memory. We do not keep logs of file operations.

12. Standards compliance

We adhere to the following security standards and recommendations:

• OWASP Top 10 — protection against the most common web application vulnerabilities.
• GDPR — personal data protection in accordance with EU Regulation 2016/679.
• CERT Polska guidelines — following recommendations from the Polish CERT team.
• Mozilla Observatory — we aim for an A+ rating in HTTP headers security test.