Security methodology

Browser-local processing

Tools execute in your browser. File bytes are not sent to a mypdf upload API. That reduces exposure to our servers — it does not make your device immune to malware, and it does not replace your organisation’s DLP policy. See How it works to verify with the Network tab.

Redaction

Drawing a black box on top of text is not enough — the text can remain selectable. Our Redact and Auto-redact PII tools rebuild matched pages as images so covered content is destroyed in the output. Always re-check: try selecting the area, searching for the old text, or run the privacy checker.

PII detection

Privacy Scanner and Auto-redact use pattern matching (emails, phones, card-like numbers, common ID formats including US and India-oriented patterns). This is best-effort — not a guarantee that every name, address, or unusual ID is found. Review every page before sharing.

Deep Clean and metadata

Deep Clean is forensic-lite hygiene: clear Info/XMP-style properties, flatten forms, drop common embeds and catalog extras. It is not a certified forensic wipe. Advanced streams may remain. It does not redact visible page text — do that with Redact first.

Hidden Content Auditor & leak check

PDF Audit and the privacy checker look for covered text, hidden text, PII-like patterns, metadata, attachments/forms, and scripts. Scores are best-effort heuristics for everyday documents.

Safe to email / Safe for AI

These workflows combine size, PII, metadata, and optional encrypt or text-only export. “Safe” means “hygiene checklist passed in this tool” — not a legal or compliance attestation for your industry.

Privacy receipts

After some privacy tools you can download a local receipt with step names and SHA-256 fingerprints of input/output bytes. Receipts are generated on your device. They are not third-party certificates or legal proof of deletion.

Limits we state openly

• OCR misreads poor scans and handwriting.
• PDF ↔ Office conversion simplifies complex layouts.
• Unlock PDF only works with a password you already know.
• Browser memory limits very large files.
• We do not claim GDPR, HIPAA, or military-grade certification.