Data handling
Encryption
- In transit: All API traffic is encrypted with TLS 1.2+. Plain HTTP requests are rejected.
- At rest: Files stored in S3 are encrypted with AES-256 (SSE-S3).
File retention
- Generated PDFs are automatically deleted after your plan’s retention period (default: 24 hours).
- Template HTML and schemas are retained until you delete them.
- Debug output (screenshots, console logs) expires with the associated PDF.
- After deletion, files are permanently removed from storage. We don’t keep backups of generated PDFs.
No content inspection
PDFBase does not read, index, analyze, or use your PDF content for any purpose beyond rendering. Your HTML, template data, and generated PDFs are never used for model training, analytics, or shared with third parties.Infrastructure
- Hosting: AWS (region details at launch)
- Rendering isolation: Each PDF render runs in an isolated browser context. No data leaks between requests or between customers.
- No shared state: Rendering instances are stateless. Your HTML and data are loaded, rendered, and discarded. Nothing persists in the rendering environment.
API security
- API key authentication: All requests require a valid API key. See Authentication.
- Key scopes: Restrict keys to specific operations (create-only, read-only, etc.).
- IP allowlisting: Restrict keys to specific IP addresses or CIDR ranges.
- Webhook HMAC signing: All webhook payloads are signed with HMAC-SHA256 for verification.
What we don’t have yet
We’re pre-launch. We don’t currently hold:- SOC 2 Type II certification
- HIPAA BAA
- GDPR Data Processing Agreement