Security
Last updated 2026-09-22
The short version
PDFCure is built so there's usually nothing to secure on our end: almost every tool processes your file entirely inside your own browser, using JavaScript running on your device. The file never leaves your computer, so it can't be intercepted in transit or exposed in a server breach — because it was never on a server. A small number of AI tools (Summarize PDF, Ask your PDF, and Translate PDF) are the exception, and are described below.
Client-side processing
For tools like Merge, Split, Compress, Watermark, Sign, Redact, and the rest of the editing toolkit, your file is read into your browser's memory, processed there using the same JavaScript engine that runs the rest of the page, and handed back to you as a download. At no point does the file cross the network. You can confirm this yourself: disconnect from the internet after a tool page has loaded, and most tools keep working.
The AI tools are different — here's exactly what happens
Summarize PDF, Ask your PDF, and Translate PDF extract the text of your document in your browser, then send that extracted text (never the original file) to our server over an encrypted connection. Our server forwards it to Anthropic's Claude API to generate a response, and returns the result to you. We don't retain this text once the request completes. If your document contains information you'd rather not send anywhere, use a different tool — the rest of the site never needs to.
Encryption in transit
Every connection to this site, including the AI tools' requests, is served over HTTPS/TLS. We don't accept plain, unencrypted connections.
Account data
Signing in with Google is optional and only needed for the AI tools — every editing tool works with no account. If you sign in, we store your name, email, profile picture, and a random account ID behind authentication in our hosting provider's database. We never see or store your Google password. You can delete your account and everything tied to it at any time from your account settings, or by asking us via the contact page.
No certifications we haven't earned
We don't display SOC 2, ISO 27001, HIPAA, or similar compliance badges, because we haven't gone through those formal audits, and displaying them without doing so would be misleading. If your use case has a specific regulatory requirement, verify it against your own organization's policy rather than a badge on this page. In practice, because most tools here never transmit your file anywhere, they sidestep most of what those certifications exist to police in the first place.
Reporting a security issue
If you find a vulnerability, we'd rather hear it from you than anyone else. Reach us via the contact page with details and, if possible, steps to reproduce it — we'll investigate and respond.
Related policies
See our Privacy Policy for what we collect and why, and our Cookie Policy for the cookies this site sets.