Security & Privacy
How My PDF protects the files you upload — temporary storage, automatic deletion, upload validation and server security, explained plainly.
Temporary File Storage
Uploaded files are written to an isolated, per-job workspace outside the public web root — never a shared or browsable folder. Nothing else on the site can read that file while your job runs.
Automatic File Deletion
Uploaded originals are removed as soon as your job finishes. Generated results are kept only long enough for you to download them — about 30 minutes — and a scheduled cleanup process also sweeps any workspace older than 30 minutes in case a job is ever abandoned.
Encryption
Your connection to My PDF is always encrypted over HTTPS, including every file upload and download. Where a tool itself deals with PDF encryption directly — Protect PDF (adding a password) and Unlock PDF (removing one you already know) — that encryption is applied to the PDF file itself using established, open-source PDF tooling; we never see or store the password you set or use it for anything beyond that single operation.
Upload Security
Every file passes through several independent checks before it ever reaches a processing tool.
Extension Whitelist
Only file extensions a given tool explicitly expects are accepted; everything else is rejected immediately.
Real Content Signature
A file's actual content is checked against its claimed type — a renamed file can't disguise itself as a PDF.
Executable Detection
Files are scanned for executable and script signatures (Windows, Linux, shell scripts) regardless of their extension.
Double-Extension Blocking
Filenames like "invoice.pdf.php" are rejected outright — a classic disguise technique for uploading something other than what it appears to be.
Corruption & Encryption Checks
Every PDF is inspected before processing to detect damage or password protection, so it never reaches a processor unable to handle it safely.
Size Limits
Uploads over 50 MB are rejected before they finish uploading, protecting server resources for everyone.
Server Security
The platform itself is hardened against the most common web application attacks.
Enforced HTTPS
Every request is redirected to HTTPS, and strict transport security headers are sent so your connection stays encrypted end to end.
Hardened Sessions
Session cookies are HttpOnly, SameSite-restricted, and session IDs rotate periodically to limit the impact of any leaked cookie.
CSRF Protection
Every form submission is verified against a session-bound token, preventing another site from triggering actions on your behalf.
Rate Limiting
Uploads, downloads and form submissions are all rate-limited per visitor, blocking automated abuse without affecting normal use.
Isolated Processing
Every job runs in its own restricted, temporary workspace directory — one visitor's file is never exposed to another's request.
Continuous Health Checks
Automated checks verify storage permissions, required tools, disk space and PHP configuration stay within safe limits at all times.
Privacy
There is no account system on My PDF, which means there is no persistent profile tied to you across visits. Files are never opened, read, scanned for content, or used for any purpose beyond the single operation you requested. Standard server logs record only what's needed to operate the site securely — see our full Privacy Policy for exactly what that includes.
Reporting a Security Concern
If you believe you've found a security vulnerability affecting My PDF, please contact us directly at contact@mypdf.tech with as much detail as you can provide. We take these reports seriously and will respond promptly.
Questions About How We Handle Your Files?
We're happy to explain anything on this page in more detail.
Contact Us