---
title: "Security certifications, and how to report a vulnerability"
description: "What security audits PDFBetter has and hasn't completed, how sign-in and payments are protected, and how to report a vulnerability to security@pdfbetter.com."
url: https://help.pdfbetter.com/privacy-security/security-certifications-and-reporting/
collection: "Privacy & security"
section: "AI & security"
updated: 2026-10-18
publisher: "PDFBetter (AI Generated Inc.)"
---

# Security certifications, and how to report a vulnerability

> PDFBetter hasn't completed a SOC 2 or ISO 27001 audit, isn't HIPAA compliant and doesn't sign BAAs. To report a vulnerability, email [security@pdfbetter.com](mailto:security@pdfbetter.com); reports are acknowledged within two business days.

## What we don't claim

PDFBetter has not completed a SOC 2 or ISO 27001 audit, is not HIPAA compliant, and does not sign Business Associate Agreements. If your work requires those, don't upload regulated data until the [security page](https://pdfbetter.com/security/) says otherwise.

## What's in place

- Files are stored in Cloudflare R2, encrypted at rest, and reached only through short-lived signed links. Connections use TLS.
- Every document request is checked against your account.
- Passwords are hashed by our authentication library; we never see or store them in plain text.
- Payments are handled by Stripe. PDFBetter doesn't store card numbers.
- Completed signature requests are [digitally sealed](https://help.pdfbetter.com/signing/signed-pdf-certificate-audit-trail/) and, when the time-stamping service is reachable, time-stamped, so later changes to the PDF are detectable.

## Report a vulnerability

1. **Write it up**: Describe the issue, the steps to reproduce it and the impact you see. Screenshots or a short proof of concept help.
2. **Email the security team**: Send it to [security@pdfbetter.com](mailto:security@pdfbetter.com), not to general support.
3. **Wait for our reply**: We acknowledge reports within two business days and keep you updated.

> **Note:** We won't take action against good-faith research that avoids other people's data. Use your own accounts and documents when testing, and don't access, change or delete anyone else's.

For account problems that aren't security issues, such as a sign-in that doesn't work, use the [contact page](https://pdfbetter.com/contact/).

### Someone used my account. What should I do?

[Change your password](https://help.pdfbetter.com/account-billing/change-email-password-sign-in/) in **Settings → Profile & signatures** with **Sign out of other devices** ticked, then email security@pdfbetter.com.

## Related articles

- [Where your files are stored and who can open them](https://help.pdfbetter.com/privacy-security/where-your-files-are-stored.md): Browser tools such as merge, split and rotate never upload your file. Documents you edit, fill or sign are stored in Cloudflare R2, encrypted at rest, and only you, people you share with and your team (for team documents) can open them.
- [What happens to your documents when you use AI](https://help.pdfbetter.com/privacy-security/ai-and-your-data.md): AI features send your document's text to OpenAI's API with storage turned off; scan restoration sends page images to fal.ai. Your documents aren't used to train models. In Settings → Data & privacy you can choose Private AI or delete stored AI data.
- [How long PDFBetter keeps your files](https://help.pdfbetter.com/privacy-security/how-long-files-are-kept.md): Guest drafts are deleted 1 hour after they're created. Files uploaded only to run a tool are deleted after 24 hours. Documents in your account stay until you delete them, then they're erased 30 days later.
- [Are PDFBetter e-signatures legally valid?](https://help.pdfbetter.com/signing/esignature-legality-and-evidence.md): Electronic signatures are generally accepted for most business documents in many countries, but some documents need more. Signature requests give every signer their own device key and a sealed, time-stamped PDF with the evidence built in. Whether that's enough depends on the law that applies to your document.
- [Change your email, password or sign-in method](https://help.pdfbetter.com/account-billing/change-email-password-sign-in.md): Open Settings → Profile & signatures. Enter a New email address and confirm it from your inbox, or change your password under Password. You can sign in with Google, Apple, an emailed link or a password.

---
Source: https://help.pdfbetter.com/privacy-security/security-certifications-and-reporting/ · PDFBetter Help Center · Last checked against the product 2026-10-18. Questions: support@pdfbetter.com