The most effective protection for a document is not sending it anywhere. That's the main design decision behind EddiesPDF, and the rest of this page explains how it works and where the exceptions are.
Files are processed on your device
For almost every tool, the processing happens in your browser. Your browser downloads the tool's code from our site, and that code opens, changes and saves your PDF on your own device. The file is not uploaded to our servers, so there is no copy for us to store, lose or delete.
Files that you open with a tool are held in your browser's memory or its local storage while you work. If you are signed in, a copy of a file you recently worked on is kept in your browser for up to 10 minutes so it can appear in your recent activity, and is then removed.
The features that use our servers
Some features can't work without a server, and we've kept that list short:
- Request signature. Your PDF is stored in Vercel Blob storage and the request details (names, email addresses, field positions, signatures and dates) are stored in Google Cloud Firestore. Each recipient gets a link with a long random identifier that can't be guessed. Anyone who has a link can open that request, so treat signing links as you would the document itself.
- Published forms. The form PDF is stored in Vercel Blob storage. The form owner's email address and every submission's details are encrypted with AES-256-GCM before they're stored, and the owner's management link is stored only as a SHA-256 hash.
- Contact form and emails. Messages you send through the contact form, and the emails we send (sign-in codes, signature notifications), go through Resend, our email provider.
All of these connections use HTTPS (TLS). Data stored with Google Cloud and Vercel is also encrypted at rest by those providers.
Accounts and sign-in
- Accounts are managed by Google Firebase Authentication. Passwords are handled by Firebase and are never stored by EddiesPDF in readable form.
- When you create an account, or sign in on a new device, we email you a six-digit code. Codes expire after 10 minutes and allow at most 5 attempts. The code itself is never stored; the server checks it against a keyed HMAC signature.
- If you choose "Remember this device", your browser keeps a signed token for 30 days so you aren't asked for a code each time on that device. Signing out from a shared computer, or clearing the site's data, removes it.
- Sign-in, code and contact endpoints are rate-limited to slow down automated guessing and abuse.
- The database is locked down with security rules. Your profile can only be read by you, and signature requests and published forms can't be read directly from a browser at all; they're only reachable through our server, which checks each request.
Protect PDF and Redact PDF
Protect PDF encrypts files with AES-256, the strongest encryption the PDF standard offers. The password is used only in your browser and is never sent to us. If you forget it, we can't recover the file.
Redact PDF removes the selected text and images from the page itself, rather than drawing a box over them, so the hidden content can't be copied out afterwards. Always check the result before you share it.
What you can do
- Use a password you don't use anywhere else, or let your browser or password manager create one.
- Sign out when you finish on a shared or public computer.
- Be careful with signing links and form links: anyone you forward them to can open them.
- Keep your browser up to date. Most of the security of browser-based tools comes from the browser itself.
Reporting a security problem
If you believe you've found a vulnerability in EddiesPDF, please email EP@eddiespdf.com with "Security" in the subject line. Include:
- what you found and where (the page or address),
- the steps to reproduce it,
- what an attacker could do with it, as far as you know.
Please give us reasonable time to fix the problem before you disclose it publicly. Don't access, change or delete data that isn't yours, don't run tests that degrade the service for others (such as load or denial-of-service tests), and don't use social engineering against us or our users. If you follow these guidelines and act in good faith, we won't pursue legal action against you for your research. We'll confirm receipt, keep you informed, and credit you if you'd like to be credited.
We don't currently run a paid bug bounty programme.
