Security

Most PDFinish tools run in your web browser using code that downloads once and then works on your device. Your files are not uploaded, so we cannot see, store or lose them. The exception is Word, Excel and PowerPoint to PDF: those tools upload the file to our converter, which deletes it as soon as the conversion finishes, runs with macros and outside links turned off, and says so on the page before you add a file.

PDFinish does not keep copies of your documents. When you close the page, the file is gone from the page. If a tool ever has to use our servers, it will say so first and we will describe how long any file is kept.

When PDFinish is live, every connection will use HTTPS (TLS). Sign-in links expire after 15 minutes and work once. Sessions use secure, HTTP-only cookies.

Email addresses, plan details and usage counts live in our database. We keep that data to the minimum needed, and access to it is limited to what is needed to run the service. See the privacy page for the full list.

Protect PDF encrypts your file with AES-256 on your device. Your password never leaves your browser, and we cannot recover it. Unlock PDF only works with a password you type yourself. We do not guess or bypass passwords.

If you find a security problem, please email hello@pdfinish.com with what you found and how to reproduce it. We will reply, work on a fix and credit you if you wish.

Please give us a reasonable time to fix the issue before you share it publicly, do not access other people's data, and do not disrupt the service.