Security

Six-layer architecture

1. 1. Browser sandbox

   PDF bytes stay in the page origin. Same-origin policy blocks other sites from reading the ArrayBuffer.

2. 2. Web Workers

   Compression runs off the main thread. The file is not posted to a remote URL.

3. 3. WebAssembly codecs

   MozJPEG and related codecs execute locally. No native plugin, no extra OS trust.

4. 4. No document ingress

   There is no upload API for PDFs. A server breach cannot leak files we never received.

5. 5. Auth isolation

   Supabase holds account data separately. Privileges are enforced by database Row Level Security and server-controlled role claims, not by a hidden URL or a browser redirect. Google Analytics measures traffic and coarse tool/download events unless you opt out of analytics. A completed-download event is emitted only when the browser file-system picker confirms a write; ordinary browser downloads are recorded as requests because the page cannot observe whether they were saved. No PDF bytes, filenames, file sizes or account ID are sent to Google Analytics. First-party usage logs are written unless analytics is opted out. Advertising tags load only on blog pages and only after you opt in; tool pages never load them. The service worker only caches /workers/ assets and never intercepts or caches PDF files.

6. 6. Transport & headers

   HTTPS and production security headers protect hosted assets and navigation. Report issues to security@bytespdf.com.

Data flows: what leaves your device, and what does not

The central design rule is that your documents are not our data. This page exists to be specific about where each kind of information goes:

• PDF files you compress, merge, clean or check: decoded, transformed and re-saved inside your browser tab. Working copies live in the tab's memory only; the compressed result is not persisted to browser storage, and closing the tab discards it.
• Account data (email address, sign-in session, waitlist entry): sent to Supabase over HTTPS when you create an account or sign in.
• Product-usage logs (tool name, file count, input sizes and page path): written as first-party analytics while analytics is enabled, then stopped when you opt out. These records are not an account document history and are not used to enforce a daily free-tier quota; file and device limits are listed on the pricing page.
• Advertising: Google AdSense may load on blog pages, and only after you opt in to the advertising category. It is denied by default, and tool pages, /verify and account pages never load ad tags. Consent and analytics preferences are stored locally; no PDF bytes are sent to analytics or advertising providers.

Document integrity protections

• Digitally signed PDFs are refused rather than rewritten. Re-compressing a signed file would silently invalidate its signature, so the compressor stops and tells you. If you need a smaller signed document, compress the source and sign the smaller copy.
• Structure is preserved on purpose: bookmarks, internal and external links, form fields, annotations, accessibility tags, document language, output intents and attachments are carried through the compression pipeline.
• Metadata cleanup is explicit: the clean tool shows what it would remove before you apply it, instead of silently stripping properties you may need.

Cookies, storage and the service worker

We keep one consent preference record in your browser's local storage so the banner does not ask on every visit. The service worker exists for offline resilience of the compression engine: it caches worker scripts and engine assets, serves navigations network-first, and never caches advertising or analytics responses. Images and fonts are served from our own domain rather than third-party CDNs, which removes a class of cross-site leakage.

Third parties we use

Each vendor below receives the minimum data its role needs. None of them receives your PDF bytes:

• Supabase

  Role: Account authentication, waitlist and subscriber storage, first-party usage logs.

  Access is restricted by Row Level Security policies; your account data is separate from any document you process.

• Brevo

  Role: Newsletter and waitlist email delivery.

  Receives only the email address you subscribe with, plus the attribution tags recorded at sign-up. Unsubscribe runs through the footer link any time.

• Google Analytics 4

  Role: Traffic measurement (opt-out: on by default until you decline analytics in the consent banner).

  Measures pages and events, never document content. The gtag script is deferred until you interact with the page or a short delay passes.

• Hostinger

  Role: Static hosting for the website files.

  Serves the same pre-built pages to every visitor. It has no document-processing role because the site has no server-side upload endpoint.

Threat model (honest)

• In scope for us: accidental document upload endpoints, XSS that could exfiltrate an open file, supply-chain on worker scripts.
• In scope for you: malware already on the device, a compromised browser extension, shoulder surfing, the portal you upload to after download.
• Out of scope: claiming HIPAA Business Associate status — we are not one. See the medical records page.

What we do not claim

• No SOC 2 or ISO 27001 certification today — we would rather say so than imply one.
• No public bug bounty; reports are read and acted on, but unrewarded.
• No absolute guarantees: a browser-local design removes the upload risk, not the device risk listed above.
• BytesPDF Pro is listed at $9.99/month. This release allows only explicitly configured Lemon Squeezy test-mode checkout; live checkout remains disabled until the product, privacy, renewal, cancellation, tax and refund terms are approved and published. No Early Bird discount or checkout code is currently offered. The pricing page shows whether test checkout is configured. If enabled, Lemon Squeezy handles payment-card data; BytesPDF stores linked subscription identifiers/status and billing-period dates, never card numbers or PDF content.

If your documents are sensitive

• Verify the destination portal address and the HTTPS lock before uploading anything, anywhere.
• Keep the original signed or scanned file; work on a compressed copy.
• Redact sensitive fields with a local tool before you share the document, not after.
• Password-protect the file before sending it over channels you do not control.
• Prefer checking size and integrity before upload with our Check PDF tool so you do not troubleshoot at the portal's error message.

Report a vulnerability

Email security@bytespdf.com. Please include steps, impact, and whether document bytes could leave the origin. We do not run a public bug bounty today.