​
Introduction

Security is important to us. We use SSL and TLS security and file encryption at rest to protect your data. You can also add user-controlled AES encryption and decryption for your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure.

​
PDF.co API Security Features

​
Hosting

PDF.co is hosted on world-class Amazon AWS infrastructure:
  • High availability cluster design: Includes robust design features for reliability.
  • Temporary files: Stored on the cloud storage with strong encryption at rest.
  • API logs: Saved for the user and available for review by user. Sensitive details are redacted or removed.
IP Addresses used by PDF.co Cloud The PDF.co Cloud is hosted on Amazon AWS infrastructure. For information about the IP addresses and IP address ranges used by AWS, you can refer to this link: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html. Moreover, we are presently utilizing us-west-2 or the Oregon region for our servers. You may find details about the AWS Regions and IP ranges in this link: https://docs.aws.amazon.com/quicksight/latest/user/regions.html.

​
API Logging

Special “Strict API logging” is available for working with a sensitive data.
  • In this mode all Request, Body and Response are redacted completely and not visible even to account owners. In other words, input and output parameters are not saved into API logs.
API logs retention: Different log storage capacities are provided according to Subscription Plans. Access to API logs, files, and templates: Restricted to account owners with temporary access control.

​
System Security & Maintenance

Documents and data processing: Processed in-memory with specific exceptions handled securely. Crash reports: Generated with redaction of user identifiable information. Server maintenance: Regularly auto-rotated and replaced with new clean server images. Allowed IP list Restrict access to the API and/or UI to a set of IP addresses only. Available through Account - Security in the PDF.co dashboard. Single-sign on (SSO, SAML) SSO mitigates compliance and security risks for organizations by giving businesses control over user authentication and user revocation via corporate-mandated tools. The availability of specific security features may vary depending on your subscription plan.

​
File Handling

Generated output files: Securely stored, encrypted at rest, and auto removed.
  • Output links automatically expire in 1 hour by default (can be decreased down to 1 minute or increased up to 24 days via the expiration parameter).
  • Uploaded and output files can also be explicitly removed using the file/delete API method.
  • You can also leverage user-controlled data encryption parameters to encrypt the content of output files automatically.
PDF.co provides built-in secure permanent file storage
  • Store documents, images, pdf templates, and other files for re-use in the API.
  • Files from the storage are available via randomly generated file tokens.
  • Available only for internal use by the PDF.co API via special filetoken:// protocol.
Password-protected documents support Password protected PDF documents are supported for input:
  • Use password parameter to include the password to open protected pdf files
Password protection support for output PDF documents Password protection and security restrictions can be added to output PDF files generated or processed through the platform.
  • The PDF.co API provides a /pdf/security/add endpoint that can enable built-in pdf documents protection:
  • Disable or enable printing
  • Disable or enable copying of content
  • Add or remove user or owner password
  • Add or remove document permissions (printing, data extraction, merging)
  • Add digital signature
The Data Encryption & Decryption API is available for automatic AES encryption and/or decryption of input/output file contents on the byte level. PDF.co can read links protected with HTTP authentication
  • Use httpusername and httppassword for http based authentication (via https) protocol;

​
Encryption Options

User Controlled Data Encryption (AES encryption) for input and output files For additional security, the platform can decrypt input files on a byte level and encrypt output files on a byte level with user controlled strong encryption (AES).
  • Automatically encrypt output files with strong AES encryption
  • Automatically decrypt input files previously encrypted with industry standard AES encryption
  • Supported encryption algorithms:
  • 256-bit AES encryption and decryption
  • 192-bit AES encryption and decryption
  • 128-bit AES encryption and decryption
  • User-controlled encryption parameters are supported by all endpoints that read or generate files
  • User controlled decryption for input files and encryption for output files can be used simultaneously within the same API call. Please check User-Controlled Encryption for more details and sample parameters.

​
Example Process

How exactly are PDF documents processed by the API in terms of security? Below is an example sequence for the pdf/edit/add process via our API:
  • Our API receives a request with an input link.
  • The request is logged in the API logs for the account unless “Strict API Logs” mode is enabled.
  • The backend server processes the request.
  • The backend server loads the source file from the provided URL into memory. Our own PDF engine parses the PDF in memory.
  • The backend server updates the PDF in memory by adding text, filling out fields, and adding images.
  • The backend server generates the final PDF and saves it into the non-public encrypted “pdf-temp-files” hosted on Amazon AWS, which is encrypted at rest by strong AES encryption.
  • The input PDF and is removed from server memory in accordance with the expiration time.
  • The backend server uses Amazon AWS to generate a temporary signed link to access the output file for a limited period of time, which is controlled via the expiration parameter.
  • The backend server sends the output link back to the requester.
  • The output link is logged in the API logs for the account unless “Strict API Logs” mode is enabled.

​
Data Transmission

Security is important for us. We use forced SSL and TLS security and file encryption at rest to protect your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure. We do not use any 3rd party API to process your documents, everything is processed on our servers only.

​
Data Encryption

Your connections to the application and API require Transport Layer Security Secure (TLS) and Secure Sockets Layer (SSL), cryptographic protocols designed to provide communications security over a computer network. Encryption is used to ensure a high level of security and privacy. When you upload documents and files, they are transmitted via encrypted connections. Your permanent files are stored behind a firewall and authenticated against the sender’s session every time a request for that file is made. We enforce the use of industry best practices for the transmission of data to our platform (Transport Layer Security TLS) and data is stored in SOC 1 Type II, SOC 2 Type I, and ISO 27001 certified data centers at Amazon AWS cloud. Your documents are stored and encrypted at rest using AES 256-bit encryption. When a file is generated by our server, it is stored under a randomized name to provide a unique link which is not possible to guess. Then the file is permanently removed after 1 hour by default. Generated files can also be removed right away using a File Upload API method at any time.

​
Data Security

Servers and data are hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:
  • ISO 27001
  • SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
  • PCI Level 1
  • FISMA Moderate
  • Sarbanes-Oxley (SOX)
  • AWS also provides an environment that enables businesses to comply with HIPAA regulations.

​
Physical Security

PDF.co utilizes ISO 27001, FISMA, HIPAA certified data centers managed by Amazon. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, and critical facilities have extensive setback and military grade perimeter control berms as well as other natural boundary protection. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state-of-the-art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. Amazon only provides data center access and information to employees who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical and electronic access to data centers by Amazon employees is logged and audited routinely. For additional information see: https://aws.amazon.com/security

​
Security Frameworks

SOC 2 compliance:
  • PDF.co is SOC 2 (Type 2) compliant. Contact us for more information.
  • PDF.co runs on SOC 2 compliant data centers provided by Amazon AWS (see Data Security and Physical Security sections above.
HIPAA compliance:
  • Document Encryption and Data Encryption support:
  • pdf/security/add and pdf/security/remove endpoints provide support for adding a password to PDF and setting up security permissions.
  • All endpoints include the password parameter for reading password protected pdf files.
  • User-controlled data encryption (AES 128, AES 192, AES 256) and AES decryption are available for auto-encrypting output files and auto-decrypting input files and documents. User-controlled data encryption is compatible with the user-controlled encryption settings in leading online platforms (such as SalesForce and others).
GDPR compliance (in progress):
  • PDF.co is in the process of implementation of GDPR. Contact us for more information.
PDF.co does not store your credit card information. When you submit your credit card information, it is passed to our payments processor Stripe, a PCI Service Provider Level 1 service, or to FastSpring (BrightMarket LCC, USA), our authorized reseller. Upon request, PDF.co will work to expunge all customer data and solely owned documents from our systems. You can delete your account from your profile page at any time. Please contact us if you need assistance with data deletion.
For more detailed information on security, please contact our Customer Support.