Security at PDFXINET
Last updated: July 2025
We treat the security of your files and personal data as a first-class concern. This page describes the measures we have in place at every layer of the stack.
1. Data in transit
All connections to PDFXINET are encrypted with TLS 1.2 or higher. We enforce HTTPS on all endpoints and redirect HTTP to HTTPS automatically. We set the Strict-Transport-Security (HSTS) header with a one-year max-age to prevent downgrade attacks.
2. File handling & automatic deletion
- Uploaded input files are stored in isolated temporary directories on the server and discarded immediately after processing completes.
- Guest (non-registered) users: processed output files are permanently and automatically hard-deleted exactly 24 hours after creation by a scheduled background job. No manual action is required.
- Registered users: processed output files are retained in your private account until you choose to delete them from the dashboard. You retain full control and can delete individual files or your entire history at any time.
- Files are never shared with other users and are inaccessible via any public URL — output download links use signed tokens with a short expiry window.
- We do not use your uploaded documents to train AI models or for any purpose other than providing the tool you requested.
3. Password & account security
- Passwords are hashed with bcrypt (adaptive work-factor). We never store plaintext passwords.
- Password requirements: minimum 8 characters with at least one uppercase letter, one lowercase letter, one digit, and one special character.
- Accounts are rate-limited and temporarily locked after repeated failed login attempts.
- Password reset tokens are single-use and expire after 1 hour.
- API tokens are generated with
secrets.token_urlsafe(32) — 256 bits of entropy.
4. Application security
- CSRF protection — all state-changing forms use Flask-WTF CSRF tokens. Tokens are auto-injected into every form via JavaScript.
- Content Security Policy — restricts script/style/resource origins to prevent XSS.
- X-Frame-Options: DENY — prevents clickjacking.
- X-Content-Type-Options: nosniff — prevents MIME-type sniffing attacks.
- Referrer-Policy: strict-origin-when-cross-origin — limits referrer leakage.
- Magic byte verification — uploaded files are validated against known file signatures before processing, not just by extension.
- File size limits are enforced per-plan server-side (not just client-side).
- Open redirects are prevented — all redirect destinations are validated before use.
5. Infrastructure
- Hosted on AWS infrastructure in EU (London) region (eu-west-2) by default, ensuring data stays in the UK/EEA.
- All servers run within private VPCs with no direct internet access to application servers.
- Nginx reverse proxy handles TLS termination and acts as a WAF layer.
- Docker containers run as non-root users with minimal capabilities.
- Database backups are encrypted at rest (AES-256) and retained for 30 days.
6. Third-party sub-processors
We work with the following sub-processors that may have access to data:
| Provider | Purpose | Location |
|---|
| Amazon Web Services (AWS) | Cloud infrastructure, compute, storage | UK / EU |
| Anthropic | AI summarisation / chat features (Pro plan only) | USA (SCCs in place) |
| Stripe | Payment processing | EU / USA |
| SendGrid / SMTP | Transactional email | EU / USA |
A full Data Processing Agreement is available at our DPA page.
7. Vulnerability disclosure
If you discover a security vulnerability in PDFXINET, please report it responsibly to security@pdfxinet.com. We ask you to:
- Not exploit the vulnerability beyond confirming it exists.
- Not access or modify user data without permission.
- Give us reasonable time (90 days) to remediate before public disclosure.
We will acknowledge your report within 48 hours and aim to resolve confirmed vulnerabilities within 30 days. We do not currently offer a bug bounty programme, but we will publicly acknowledge responsible disclosures (with your consent).
8. Penetration testing & audits
We conduct internal security reviews on every significant release. Enterprise customers may request the results of our most recent third-party penetration test under NDA by contacting security@pdfxinet.com.
9. Incident response
In the event of a personal data breach, we will notify affected users and the Information Commissioner's Office (ICO) within 72 hours as required by UK GDPR Article 33. We maintain a documented incident response procedure and will provide transparent communication about the nature, scope, and remediation of any incident.