Security

Last updated: 27 Jul 2026

Encryption in transit

All traffic to PDFDocFuse — uploads, downloads, and page loads — travels over HTTPS.

File access

Uploaded and processed files are stored outside direct web access and can only be downloaded through a gated link that checks you're the file's owner (by your logged-in session, or a matching anonymous device cookie for guests). Files are never publicly browsable.

Files auto-delete 24 hours after processing on the Free plan, or 30 days on paid plans — enforced by a server-side cleanup job, not just by the browser, so it happens even if you never come back.

Passwords and account credentials

Passwords are hashed with PHP's password_hash() before storage — we can't see or recover your actual password, only verify it. Emailed one-time sign-in codes and password-reset links are hashed and single-use, and expire automatically (10 minutes for codes, 1 hour for reset links).

Stored API keys and connected accounts

If you're the site admin, third-party API keys and secrets (payment gateways, conversion services, cloud storage) are encrypted at rest before being saved, not stored as plain text. OAuth tokens for connected cloud storage accounts (Google Drive, Dropbox, OneDrive) are encrypted the same way.

Bot and abuse protection

Signup, login, and one-time-code requests are protected against cross-site request forgery, and can optionally require Google reCAPTCHA verification. Free-plan usage is rate-limited per account and per anonymous visitor.

Payments

Subscription payments are processed entirely by Razorpay or Stripe, both PCI-DSS compliant payment processors. Your card or UPI details are entered directly with them — PDFDocFuse's servers never see or store your payment details.

File sharing

Share links you create can optionally require a password and/or expire after a set time or number of downloads, so you control exactly who can access a shared file and for how long.

Reporting a vulnerability

If you believe you've found a security issue, please email security@pdfdocfuse.com with details before disclosing it publicly — we'll respond as quickly as we can.