Security and Privacy

Why "no server upload" matters

Most online PDF tools process your file on their servers. It's convenient, but it comes with unavoidable risks:

• The service provider's staff could view your file contents.
• If the server is hacked, your files may leak.
• File contents may persist in server logs or backups.
• Legal disclosure requests could expose your files to third parties.

StayPDF structurally eliminates these risks by doing no server-side processing at all. Every operation runs inside your browser, and your files never even reach our servers.

How it works technically

1. Client-side processing

Merging, splitting, compressing, converting — everything runs in your browser using open-source libraries such as pdf-lib and pdf.js. There is no "send result to server" request at any step.

2. Content Security Policy (CSP) enforced by your browser

Even if StayPDF's own code had a bug, or the delivery path were compromised, your browser still protects you thanks to a strict Content Security Policy.

The CSP applied to tool pages (merge, split, compress, image-to-PDF, PDF-to-image, etc.) is:

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'wasm-unsafe-eval' blob:;
  connect-src 'self';
  worker-src 'self' blob:;
  object-src 'none';
  frame-ancestors 'none';
  ...

The critical directive is connect-src 'self'. With this in place, any network request from a tool page to any domain other than StayPDF's own is physically blocked at the browser level. Even if a script tried to exfiltrate your file, the browser would refuse the request outright.

3. No third-party scripts on tool pages

Tool pages ship without Google Analytics or any other third-party code. On pages that handle PDFs, only StayPDF's own code runs — nothing else.

The home page and blog posts do use Google Analytics for usage metrics, but those pages never handle PDF files.

Verify it yourself

You don't have to take our word for it. You can confirm with your browser's developer tools that no file ever leaves your machine:

1. Open a tool page, e.g. Merge PDF.
2. Press F12 (or Cmd+Option+I on Mac) to open the developer tools.
3. Switch to the "Network" tab and start recording.
4. Select a PDF and run the operation.
5. You'll see that no upload request is made at any point during or after processing.

You can use this same procedure on any competing service. Comparing the network traffic makes the difference very clear.

Comparison with traditional online services

Scope and caveats

The privacy guarantees above apply to every PDF tool StayPDF currently offers (merge, split, compress, image conversion, password removal, page organization, watermark, signature, page numbering, and so on).

We may add advanced features in the future that require server-side processing (cloud storage, cross-device sync, AI). If we do, we will clearly disclose it at the point of use. The browser-only policy for our existing tools will not change.

What we cannot protect against

For transparency, here are risks that StayPDF's design cannot mitigate:

• A compromised device. If your computer has malware, no web service is safe.
• Malicious browser extensions. Extensions may have permission to read page contents.
• A compromised delivery path (Cloudflare). Even then, CSP blocks outbound traffic at the browser level, limiting the damage.
• Zero-day browser vulnerabilities. Please keep your browser up to date.

These risks apply to every web service, not just StayPDF.

Security contact

If you find a vulnerability in StayPDF, or have any security-related question, please email [email protected]. We will respond promptly and in good faith.