The essentials: OléPDF is a suite of PDF tools that processes your documents 100% in your browser. Whether you merge, split, compress, convert, edit or anonymize, your files are never uploaded to any OléPDF server, never stored, and never accessible to our team. Text extraction, OCR, AI models, and output PDF generation all happen locally on your device.
1. Threat model
Being explicit about what OléPDF does and does not protect against is the only honest way to evaluate the suite. Here are the boundaries:
✓ What it protects
- Third-party exposure of your document during processing: because every tool (merge, split, compress, convert, edit, anonymize...) works only in your browser and never uploads the file, no operation leaves your documents on a server
- Leakage of personal data when anonymizing PDFs: visual redaction + rasterization of pages with detections, removing text, vector layers and hidden metadata
- Invisible text or hidden OCR under vector objects (the classic "selectable redaction" leak)
- PDF metadata (author, software, date) on rasterized pages when anonymizing
- Embedded QR codes, barcodes and signatures containing identifying data
- Faces and ID/passport photos in images
✗ What it does NOT cover
- User device compromise (malware, keyloggers, compromised browser)
- Screen captures or cameras in the user's environment
- Leaks after the document is exported (how you share it is on you)
- Detection errors: anonymization is assisted and no automatic detection system is perfect; it does not guarantee 100% of detections. We recommend a human review before publishing
- Documents in formats a given tool does not support
- Anonymization or processing of databases, backend systems, or third-party pipelines
2. Security architecture
OléPDF's strongest security argument is structural: we cannot see your documents because they never reach our servers, whichever tool you use.
Client-side processing
Every tool in the suite (merge, split, compress, convert, edit, OCR, anonymize...) runs in the browser using WebAssembly and Web Workers. Files never leave your device.
Self-hosted models
Engines that need models (AI data detection, OCR, face detection and barcode/QR reading) are served as static assets and WebAssembly from our own origin, with no content telemetry.
No content telemetry
We do not log what you process, what text your documents contain, or how many entities appear. Anonymous stats are limited to page visits and aggregated performance metrics.
Strict HTTPS and CSP
All traffic uses TLS 1.2+. The app is served with restrictive Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy headers.
No external CDNs
Fonts, scripts, and models are self-hosted. No Google Fonts, no trackers, no pixels. GDPR compliance by design.
Session isolation
Each browser session is independent. Closing the tab discards in-memory documents. Processed content is never persisted.
The cost of local processing: performance depends on your browser, memory, and device. Very long scanned PDFs, OCR, and some conversions can take longer or require a desktop computer; smaller documents work best on mobile.
3. Data and retention
Your document content is never stored. These are the only data points the platform actually handles:
| Data | Source | Purpose | Retention |
|---|
| Email |
License purchase |
License delivery and service communications |
License lifetime + tax obligations |
| License key |
Generated at purchase |
Validate access to Pro features |
License lifetime |
| Payment data |
Stripe Checkout |
Payment processing |
Handled by Stripe (we do not store card data) |
| Anonymous statistics |
Site visit or app usage |
Improve the service |
Aggregated, no personal identifiers |
| Backend technical logs |
Server |
Diagnostics and security |
30 days max, IPs truncated |
The content of your PDFs never appears in this table because it never reaches our servers. Full legal detail in Privacy Policy.
4. Subprocessors
External providers that process data on behalf of OléPDF. None of them have access to the content of your documents.
| Provider | Service | Data accessed | Location |
|---|
| Stripe |
Payment processing |
Email, payment data, amount |
EU / US (standard contractual clauses) |
| Arsys.es |
Web and PHP backend hosting |
Technical logs, license database |
EU |
| cron-job.org |
External cron trigger |
Endpoint protected with a shared key |
EU |
If we add or change a subprocessor, we will reflect it here and in the changelog at the bottom of this page.
5. Secure development
- Private GitHub repository with code review and main-branch protection
- PHP backend using prepared statements (PDO) for all database operations
- Input validation and sanitization on public endpoints; rate-limiting on sensitive endpoints (licenses, redemptions, gifts)
- Admin endpoints protected by an admin key (
X-Admin-Key header) and never exposed in the frontend
- Cookies set with appropriate
HttpOnly, Secure, and SameSite flags
- Security headers:
Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin
- Frontend (npm) and backend dependencies reviewed; automated audits on every deploy
- Reproducible builds with embedded commit hash for traceability
6. Licenses and secrets
- License keys are generated on the server with cryptographic entropy (non-guessable)
- License verification transmits only the key, never PDF content or document metadata
- Backend secrets (Stripe keys, webhook secret, admin key) live in
config.php outside version control, with restricted filesystem permissions
- The frontend contains no secrets: checkout is initiated via a Stripe session created on the backend
- Third-party API keys the client needs (public geolocation, etc.) are read-only and domain-restricted
7. Backups and availability
- Daily backups of the license database, stored outside the public web directory
- Source code lives on GitHub and is the single source of truth; backups focus on non-reproducible state (database)
- Documented restore plan: import scripts + tested manual procedure
- Availability: the app is static (HTML/JS) served via CDN, minimizing extended outage risk
8. Security contact
If you have questions about our architecture, want to discuss any aspect of how we handle data, or have spotted behavior that looks like a possible security issue, drop us a line. We will look into it and get back to you.
9. Compliance
- GDPR: client-side processing and the absence of content storage drastically reduce the processing surface. OléPDF acts as a processor only with respect to account data (email, license)
- Spanish LSSI: controller details are published in our Legal Notice
- International transfers: Stripe (subprocessor) operates under standard contractual clauses
- External audits: we are evaluating periodic external penetration testing. When completed, we will publish an executive summary on this page
10. Changelog
There are no published product updates yet.