1. Our security principles
- Process locally first. Most tools run in your browser with WebAssembly and JavaScript, so the document never leaves your device.
- Keep nothing we don't need. Server files are temporary and deleted automatically.
- Defence in depth. Every layer – network, application, storage – assumes the others could fail.
2. Processing architecture
| Engine | Used by | Where your file goes |
|---|---|---|
| Browser engine | Merge, split, rotate, organise, edit, sign, watermark, protect, unlock, encrypt, redact, OCR, PDF to images/Word/Excel/PowerPoint/text and more | Stays on your device. Only anonymous usage counters (tool, file count, size, duration) reach our servers. |
| Server engine | Word/Excel/PowerPoint/HTML to PDF and, when enabled, Compress and PDF/A | Encrypted HTTPS upload → isolated temporary job folder with random file names → conversion → signed, expiring download link → automatic deletion |
Each tool page tells you which engine it uses ("Processed in your browser" or "Encrypted upload, auto-deleted").
3. File handling safeguards
- File type checked by extension and content (magic bytes); size and count limits enforced on the server.
- Randomised storage names outside the public web root; path traversal and direct execution are blocked.
- Optional malware scanning integration (ClamAV) before processing.
- Downloads only through HMAC-signed links that expire; internal paths are never exposed.
- Automatic deletion after at most 60 minutes, plus an instant Delete files button.
- Processing time limits and failed-job cleanup.
4. Encryption
- TLS (HTTPS) for all traffic, with HSTS.
- PDF protection uses AES-256 encryption via the qpdf engine.
- Sensitive settings such as SMTP and API keys are encrypted at rest with libsodium.
5. Account security
- Passwords hashed with Argon2id (or bcrypt) – we never store them in plain text.
- Brute-force protection: rate limits per network and temporary account lockout.
- Secure, HttpOnly, SameSite cookies; CSRF tokens on every form; sessions invalidated on password change.
- Separate, time-limited admin sessions, role-based permissions and audit logs for administrative actions.
6. Web application security
Strict Content Security Policy with per-request nonces, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers; prepared SQL statements throughout; output encoding to prevent XSS; no raw stack traces shown to users.
7. Privacy-first analytics
Our analytics are cookieless and store only daily-rotating hashed identifiers – no raw IP addresses. Optional Google services load only according to your consent choices. See the Privacy Policy.
8. Responsible disclosure
Found a vulnerability? Please email info@totopdf.com with the subject "Security report", including steps to reproduce and the potential impact. We ask that you:
- give us reasonable time to fix the issue before public disclosure;
- avoid accessing or modifying other users' data, degrading the service or social engineering;
- only test against your own account.
We will acknowledge your report within 3 business days, keep you informed, and credit you (if you wish) once the issue is fixed.