# Security methodology

> Plain language about what mypdf.space does when you redact, clean, or check a PDF — and what we do not claim.

Canonical: https://mypdf.space/security-methodology
Last updated: 2026-10-26

## Browser-local processing

Tools execute in your browser. File bytes are not sent to a mypdf upload API. That reduces exposure to our servers — it does not make your device immune to malware, and it does not replace your organisation’s DLP policy. See [How it works](https://mypdf.space/how-it-works) to verify with the Network tab.

## Redaction

Drawing a black box on top of text is not enough — the text can remain selectable. Our [Redact](https://mypdf.space/redact-pdf) and [Auto-redact PII](https://mypdf.space/auto-redact-pii) tools rebuild matched pages as images so covered content is destroyed in the output. Always re-check: try selecting the area, searching for the old text, or run the [privacy checker](https://mypdf.space/check-pdf-for-hidden-data).

## PII detection

Privacy Scanner and Auto-redact use pattern matching (emails, phones, card-like numbers, common ID formats including US and India-oriented patterns). This is best-effort — not a guarantee that every name, address, or unusual ID is found. Review every page before sharing.

## Deep Clean and metadata

[Deep Clean](https://mypdf.space/deep-clean-pdf) is forensic-lite hygiene: clear Info/XMP-style properties, flatten forms, drop common embeds and catalog extras. It is **not** a certified forensic wipe. Advanced streams may remain. It does not redact visible page text — do that with Redact first.

## Hidden Content Auditor & leak check

[PDF Audit](https://mypdf.space/pdf-audit) and the [privacy checker](https://mypdf.space/check-pdf-for-hidden-data) look for covered text, hidden text, PII-like patterns, metadata, attachments/forms, and scripts. Scores are best-effort heuristics for everyday documents.

## Safe to email / Safe for AI

These workflows combine size, PII, metadata, and optional encrypt or text-only export. “Safe” means “hygiene checklist passed in this tool” — not a legal or compliance attestation for your industry.

## Privacy receipts

After some privacy tools you can download a local receipt with step names and SHA-256 fingerprints of input/output bytes. Receipts are generated on your device. They are **not** third-party certificates or legal proof of deletion.

## Limits we state openly

- OCR misreads poor scans and handwriting.
- PDF ↔ Office conversion simplifies complex layouts.
- Unlock PDF only works with a password you already know.
- Browser memory limits very large files.
- We do not claim GDPR, HIPAA, or military-grade certification.

## Related

- [Privacy](https://mypdf.space/privacy)
- [How it works](https://mypdf.space/how-it-works)
- [Changelog](https://mypdf.space/changelog)