Security at Free PDF Editor

Free PDF Editor — a QEPL Technologies brand · Last updated: 23 October 2026

The short version: we collect almost nothing, keep files only while they are being used, encrypt every hop, hash credentials and hand card data to the payment gateway. The full Privacy Policy explains what is stored and why; this page explains the controls that protect it.

1. Encryption in transit

Everything that moves between your browser and our servers is encrypted with HTTPS/TLS — uploads, forms, downloads and API calls alike. The application is deployed behind a TLS-terminating proxy and trusts the forwarded protocol only from that proxy, so a forged request header cannot make the app treat a plain connection as secure. Downloads are served with the browser's caching disabled, so a shared computer does not keep a copy of your result.

2. Files: storage and deletion

• Unguessable ids. Every upload and result is stored under a random UUID; the id is the only handle, and ids are never derived from your name or your document.
• No listing. There is no endpoint that lists documents. A file is reachable only through the link produced for that run.
• Automatic deletion. A background janitor sweeps the temp store every ten minutes and removes files that have gone unused for the retention window — 72 hours in the current deployment. Opening, previewing, downloading or keeping the editor tab open counts as use and resets the clock, so only abandoned files age out. The authoritative statement is §13 of the Privacy Policy.
• Originals are never modified. Every tool works on a copy; your source file stays as you uploaded it.
• You can delete on demand. The preview screen's delete action removes the stored file immediately, ahead of the sweeper.

3. Accounts and sign-in

• Passwords are hashed. We store a modern one-way hash (Werkzeug's scrypt-based hash), never the password itself. A password change re-hashes the new value; nothing can be read back out of the database.
• Verification codes. Sign-up and password-reset codes are hashed at rest, expire after ten minutes, allow a limited number of attempts and can be resent only after a cooldown.
• CSRF protection. Every state-changing form — sign-in, sign-up, profile changes, payments, admin actions — carries a per-session CSRF token that the server verifies.
• Sessions. The session cookie is signed with the app's secret key and is the only cookie required for an account. Signing out clears it.
• API keys. Keys are shown once, can be revoked in one click, and stop working the moment they are revoked.

4. Payments

Purchases run through Razorpay's Standard Checkout, opened in the gateway's own secure frame. Card numbers, CVVs and banking details are entered there and are never sent to our servers. We receive the gateway's order reference and the verified payment result, together with the billing details you choose to provide for the invoice. A payment is only credited after the gateway's signature is verified.

5. E-Sign and LegalWorkflow

E-Sign and LegalWorkflow are the two exclusive, account-only products in the suite, and their data follows stricter rules than the free tools:

• E-Sign. An envelope keeps the uploaded PDF and the recipients' signing details until the request is completed, expires or is withdrawn — expiry, renewal and request search need them. Signing links are private, single-purpose and expire with the request. Signed copies come with a certificate and audit trail.
• LegalWorkflow. The e-stamp, photo or PDF you open is a temporary working file and follows the ordinary retention window. Templates and writing settings are saved in your own browser's local storage, not in a server-side document library — clearing this site's browser data removes them.

6. Where data is processed

The application runs on a managed container host, the accounts database is managed separately, and transactional email is delivered by an email provider. Each processor acts on our instructions and is listed in §11 of the Privacy Policy. Data centres are chosen for proximity to our users; data may therefore be processed in a country other than yours, under the safeguards those providers commit to.

7. What we do not do

• We do not train AI models on your documents, and no human reviews them.
• We do not run third-party ad or analytics trackers on the tools.
• We do not sell, rent or trade personal data.
• We do not keep a document library, trash folder or archive.
• We do not ask for more than an email address and a username to create an account.

8. Reporting a vulnerability

If you believe you have found a security issue, please tell us before disclosing it publicly: write to pdfedit@freepdfeditor.recollem.me with enough detail to reproduce it. We will acknowledge your report, investigate, and keep you informed of the fix. Please do not access other people's data, disrupt the service, or run automated scans that degrade it while testing.

9. Policies and contact

This page describes the controls; the binding documents are the Privacy Policy, the Terms & Conditions and the API Terms. Questions about any of them: pdfedit@freepdfeditor.recollem.me.

Free PDF Editor — a QEPL Technologies brand
New Town Business District,
Rajarhat, Kolkata – 700156,
West Bengal, India