Security Overview
At OncePDF, your security is our architectural foundation. This document provides a comprehensive, transparent look into how we engineer our platform to protect your sensitive documents, secure our infrastructure, and guarantee your privacy across every interaction.
Security at a Glance
Zero Uploads
Files are processed entirely within your device's browser memory using local WebAssembly. They never touch our servers.
TLS Encryption
All connections to OncePDF are secured with industry-standard TLS 1.2 or higher, ensuring data in transit is protected.
Privacy First
We adhere strictly to data minimization principles. We do not track, index, or store the contents of your documents.
Bug Bounty
We operate a responsible disclosure program, working actively with security researchers to eliminate vulnerabilities.
1. Browser-Based Processing
The fundamental security advantage of OncePDF lies in our architectural decision to process files directly on your device rather than uploading them to the cloud. We achieve this by leveraging WebAssembly (WASM) and modern JavaScript APIs.
When you use a tool like our PDF Editor, PDF Merger, or PDF Compressor, the underlying software engine is downloaded to your browser. Your browser then executes this engine locally. This means that the mathematical operations required to alter your PDF happen directly on your CPU and RAM.
Why this matters: Because your files never leave your computer, they are completely immune to network interception attacks, man-in-the-middle attacks, or data breaches targeting our central servers. We physically cannot leak your documents because we never have them in the first place.
2. Secure File Handling
Even though files are processed locally, we enforce strict rules on how memory is handled during the lifespan of your session on OncePDF.
Volatile Memory
Files are held in temporary browser memory. When you close the tab, the memory is purged by your operating system.
No Persistent Storage
We do not utilize LocalStorage or IndexedDB to persistently save your document content between sessions.
Isolated Execution
Our WebAssembly modules run in a sandboxed environment, isolated from the rest of your operating system.
No Server Backups
Because we do not upload your files, there are no shadow copies, backups, or residual data left on remote servers.
3. HTTPS & Data Protection
While your documents remain local, interacting with our website still requires a secure connection to download the tool scripts and authenticate your account (if you choose to create one).
All traffic between your device and OncePDF is transmitted over HTTPS (Hypertext Transfer Protocol Secure). We enforce TLS (Transport Layer Security) 1.2 or higher for all connections. This cryptographic protocol ensures that any data you send us—such as account login credentials, contact form submissions, or premium subscription data—is heavily encrypted and protected from eavesdropping.
We also implement HSTS (HTTP Strict Transport Security), which instructs your web browser to only communicate with our servers over secure HTTPS connections, mitigating the risk of downgrade attacks.
4. Infrastructure Security
The servers that host the OncePDF application code, user accounts, and analytical data are protected by enterprise-grade security configurations.
- DDoS Protection: We route our traffic through Cloudflare, providing robust defense against Distributed Denial of Service attacks and layer-7 web attacks.
- Web Application Firewall (WAF): Automated firewalls inspect incoming traffic for malicious payloads, SQL injection attempts, and Cross-Site Scripting (XSS).
- Least Privilege Access: Internal access to our production infrastructure is strictly limited to authorized engineers via secure, authenticated VPN tunnels.
- Patch Management: We maintain a rigorous schedule for patching our underlying operating systems, web servers, and dependencies to protect against known CVEs (Common Vulnerabilities and Exposures).
5. Privacy by Design
Data Minimization Principle
Our core engineering philosophy is Data Minimization: we do not collect what we do not strictly need. The best way to secure data is to not hold it.
Privacy is not just a policy for us; it is embedded in the architecture of our application. By pushing the computational workload to the client-side, we inherently preserve the privacy of the document contents. Our analytics and logging systems are configured to anonymize IP addresses and avoid capturing any personally identifiable information (PII) beyond what you voluntarily provide during account registration.
6. Responsible Disclosure Policy
We deeply value the work of independent security researchers. If you believe you have discovered a security vulnerability in OncePDF, we ask that you disclose it to us responsibly before making it public.
Guidelines for Researchers:
- Do no harm: Do not exploit the vulnerability to view, modify, or destroy data belonging to other users.
- Report promptly: Email your findings to security@oncepdf.com with detailed steps to reproduce the issue.
- Provide time: Allow our engineering team a reasonable timeframe (typically 30-90 days) to validate and patch the vulnerability before you disclose it publicly.
- No extortion: Do not demand payment as a condition of disclosing a vulnerability.
We are committed to acknowledging valid vulnerability reports and working swiftly to resolve them.
7. Security Best Practices for Users
While we secure the platform, security is a shared responsibility. We recommend our users follow these best practices to ensure maximum protection of their digital assets:
Strong Passwords
If you create an account, use a strong, unique password generated by a trusted password manager.
Update Your Browser
Because we process files locally, keeping your browser updated ensures you have the latest sandboxing and V8 engine security patches.
Secure Networks
Avoid handling highly sensitive documents (like tax returns or medical records) while connected to unencrypted public Wi-Fi networks.
Malware Scans
Ensure your local device is free of malware, keyloggers, or malicious browser extensions that could intercept your files locally.
8. Third-Party Services
To deliver a reliable global service, OncePDF relies on a carefully vetted list of third-party vendors. We conduct security reviews of these providers to ensure their standards meet our own.
- Hosting & Compute: Our application servers are hosted in secure, ISO-27001 certified data centers.
- Content Delivery Network (CDN): Cloudflare is used to serve our static assets quickly and securely, providing WAF and DDoS mitigation.
- Analytics: Google Analytics is used for aggregate performance metrics, configured to respect privacy constraints.
- Advertising: Google AdSense is used on our free tier to support the platform, utilizing industry-standard ad security measures to prevent malvertising.
9. Contact the Security Team
Security concerns, vulnerability reports, and privacy questions are treated with the highest priority by our engineering team.
Lumewise Technology Pvt. Ltd.
1st Floor, Bixcel Building, 62
Sengunthapuram Main Rd
Karur, Tamil Nadu 639002, India.
Security FAQ
Does OncePDF upload my documents to the cloud?
If you don't upload files, how do the tools work?
Is the connection to OncePDF secure?
Do you keep copies of my converted files?
How do you handle user account passwords?
Is OncePDF compliant with GDPR and CCPA?
Do your third-party advertisers have access to my files?
How do I report a security vulnerability?
Are my payment details secure?
How often is OncePDF updated?
Verified Tool | Maintained by OncePDF Engineering | Last updated: