Security
At a glance
Connections to PDFengine are encrypted and the site enforces HTTPS.
Conversion results are stored encrypted, with a separate key per file.
Your source file is deleted as soon as the conversion has finished.
Your results are deleted automatically after 7 days.
Files you have converted are scanned for viruses.
We don't view your files for our own purposes.
Your files and how long we keep them
When you upload a file, it only sits on our server to carry out the conversion. As soon as the conversion has succeeded, we delete the source file. While the conversion is running, the file is readable on our server; that is why we keep it as briefly as possible.
If you have uploaded a file but not yet started the conversion, we keep it for 24 hours at most. If a conversion fails, we delete the source file at the latest 6 hours after the upload.
If your conversion is still waiting for you to confirm your email address, we keep your files until the conversion has run, and for 7 days at most.
A password you enter to open a protected PDF is erased 24 hours after the conversion has finished.
Conversion results stay available for download for 7 days and are then deleted automatically. You can delete them earlier yourself.
How long we keep account data, invoices and technical logs is set out in our privacy policy.
Who can access your files?
We don't view, analyze or copy your files for our own purposes. A staff member only looks at a file if your support request requires it and you give permission, or if the law requires us to.
Encryption
We store the result of a conversion encrypted with AES-256, using a unique key per file. This is not "zero knowledge": our own application can decrypt the files in order to deliver them to you.
Virus scanning
Files you upload to convert are scanned for viruses before we process them. If the scan finds something, the conversion stops with an error message, you get no result and we refund the credits. The scan applies to conversions through the website, the API and the Claude connection (MCP).
Signing in and access
You can sign in with a password, with a code we email you, or with Google. You can turn on two-step verification with an authenticator app and recovery codes in your profile.
For integrations you use personal API tokens. You create them yourself in your profile.
Hosting and external services
PDFengine runs on its own server in a data center in Amsterdam.
For part of the conversions, such as Office files and images, we use an external conversion service, located in the EU. For AI features, such as extracting data from documents, we use an external AI service. We also use external services for payments and email. These parties work on our behalf.
Questions or reporting something
If you have a security question or want to report something, email us at contact@pdfen.com.
More about how we handle data is in our privacy policy and terms and conditions.