Security certifications, and how to report a vulnerability
PDFBetter hasn't completed a SOC 2 or ISO 27001 audit, isn't HIPAA compliant and doesn't sign BAAs. To report a vulnerability, email [email protected]; reports are acknowledged within two business days.
Updated 1 min read
On this page (3)
What we don't claim
PDFBetter has not completed a SOC 2 or ISO 27001 audit, is not HIPAA compliant, and does not sign Business Associate Agreements. If your work requires those, don't upload regulated data until the security page says otherwise.
What's in place
- Files are stored in Cloudflare R2, encrypted at rest, and reached only through short-lived signed links. Connections use TLS.
- Every document request is checked against your account.
- Passwords are hashed by our authentication library; we never see or store them in plain text.
- Payments are handled by Stripe. PDFBetter doesn't store card numbers.
- Completed signature requests are digitally sealed and, when the time-stamping service is reachable, time-stamped, so later changes to the PDF are detectable.
Report a vulnerability
Step 1: Write it up
Describe the issue, the steps to reproduce it and the impact you see. Screenshots or a short proof of concept help.
Step 2: Email the security team
Send it to [email protected], not to general support.
Step 3: Wait for our reply
We acknowledge reports within two business days and keep you updated.
For account problems that aren't security issues, such as a sign-in that doesn't work, use the contact page.
Someone used my account. What should I do?
Change your password in Settings → Profile & signatures with Sign out of other devices ticked, then email [email protected].
Did this answer your question?
Related articles
- Where your files are stored and who can open themBrowser tools such as merge, split and rotate never upload your file. Documents you edit, fill or sign are stored in Cloudflare R2, encrypted at rest, and only you, people you share with and your team (for team documents) can open them.
- What happens to your documents when you use AIAI features send your document's text to OpenAI's API with storage turned off; scan restoration sends page images to fal.ai. Your documents aren't used to train models. In Settings → Data & privacy you can choose Private AI or delete stored AI data.
- How long PDFBetter keeps your filesGuest drafts are deleted 1 hour after they're created. Files uploaded only to run a tool are deleted after 24 hours. Documents in your account stay until you delete them, then they're erased 30 days later.
- Are PDFBetter e-signatures legally valid?Electronic signatures are generally accepted for most business documents in many countries, but some documents need more. Signature requests give every signer their own device key and a sealed, time-stamped PDF with the evidence built in. Whether that's enough depends on the law that applies to your document.