Security: the standards we apply

Sırdaş processes your files inside your browser. That changes the security conversation: there is no server to protect, no database to encrypt, no backup to lose. What there is, is a body of standards describing how an application like this should be built — here is which ones we follow and how to check.

First, what we are not

We are not certified under ISO/IEC 27001, SOC 2 or anything else. Nobody has audited us.
A certification is granted to an organization after an accredited auditor reviews it. We apply the controls and the methodology those standards describe, which are public and free; that is not the same as being certified, and we will not imply that it is.
We also hold no backups of your documents. That is not a gap: we store nothing, so there is nothing to back up.
When someone says "ISO 27001 compliant" with no certificate number and no certification body, what they are saying is "trust us". We would rather hand you the check.

The standard we adopt

Out of every standard available we picked one and actually follow it: OWASP's Application Security Verification Standard. It is not an organizational standard, it is a list of verifiable requirements about one specific application — which is exactly what we are.

OWASP ASVS, Level 1

It is public and free: anyone can read the requirements and check whether we meet them, without asking us or paying for an audit.
It applies to the application, not to the company. An organizational seal says nothing about the path your file takes; an ASVS requirement does.
The self-assessment lives in the repository, next to the code, and changes when the code changes.

Architecture and design: There is no server component that processes documents. The server-side attack surface is a static file host.
Authentication and sessions: No accounts, no passwords, no sessions, no session cookies. The requirement is met by the mechanism not existing.
Access control: There is no user data another user could reach, because there is no shared storage.
Input validation: Every PDF that arrives is treated as hostile: a damaged file or a non-PDF produces an error with a message, never a silent failure. Covered by automated tests.
Cryptography: Everything is served over HTTPS with HSTS. We do not roll our own crypto.
Logging and monitoring: We do not log the contents of your files, because they never reach a log: they never leave your browser.
Configuration: Security headers applied and checked by automated tests: CSP, X-Content-Type-Options, Referrer-Policy, frame-ancestors.
Dependencies: Third-party libraries are served from our own domain, never from someone else's CDN, and are updated with the repository.

Read the full self-assessment, control by control (in Spanish)

ISO/IEC 27002 controls we do apply

ISO/IEC 27002 is the control catalogue ISO/IEC 27001 refers to. These are the specific controls that make sense for an application that stores nothing, with what we do for each and how to check it. Organizational controls (people, facilities, suppliers, continuity) do not apply to a static site and we are not going to pretend otherwise.

8.12Data leakage prevention

The site is served with a Content-Security-Policy including connect-src 'self'. The browser blocks any transmission to an external server, even if the code tried.

How to check: Look at the response headers in DevTools, Network tab.

8.11Data masking

IDs, tax numbers, names, emails, phones, addresses and dates become consistent placeholders before you copy the text into an AI. The same value always becomes the same placeholder.

How to check: Drop a document into PDF to Markdown and read the findings list.

8.10Information deletion

There is no deletion to schedule: the file is never written to any disk of ours. Close the tab and the browser frees the memory, leaving no copy.

How to check: No competitor that processes server-side can say this; they promise deletion within one or two hours.

8.24Use of cryptography

HTTPS enforced with HSTS across the site. We do not encrypt your documents because we do not transport them: there is no transit to protect.

How to check: The padlock in your browser, and the Strict-Transport-Security header.

8.26Application security requirements

The no-upload promise is written as an automated test: if anyone introduced a network call to another domain in the PDF code, the test fails and it does not ship.

How to check: The file test/no-network.test.ts in the repository.

8.28Secure coding

TypeScript in strict mode, no implicit any. Errors are classified and turned into a message explaining what happened, instead of being swallowed.

How to check: The code is public in the repository.

8.8Management of technical vulnerabilities

Dependencies are pinned and served from our own domain. Nothing loads from a third-party CDN, not even the OCR model, which is 11 MB and hosted here.

How to check: Search for any external domain in the Network tab: there is none.

5.34Privacy and protection of PII

Processing of personal data happens on your device, under your control. We are not the controller for your documents' contents because we never receive them.

How to check: Turn the wifi off and keep using the tool.

Data protection law

These are claims about how the application is built, not certifications. They hold because there is no server-side processing.

GDPR, article 5(1)(c) — data minimisation: The minimum possible data is none. We do not collect the document, nor its name, nor its size, nor its page count.
GDPR, article 25 — data protection by design and by default: It is not a setting you have to switch on: the architecture has no upload step. By default, with no exception.
Law 1581 of 2012 (Colombia) — personal data protection: We are neither controller nor processor for your documents' contents, because we never receive or store them at any point.
Content Security Policy Level 3 (W3C): The standard that stops all of the above from resting on our good faith. The browser is what enforces it.

What this page does not claim

So it is on the record, and so you can hold us to it:

We do not claim to be the number one PDF site. We are not: iLovePDF and Smallpdf have hundreds of millions of users.
We do not claim any certification. If we ever earn one, the certificate number and the issuing body will be on this page.
We do not claim the anonymization is perfect. It is rule-based, and rules can miss an unusual format. Always review before sharing a sensitive document.
We do not claim your device is secure. If your machine is compromised, no web application can protect you.

If you find a flaw

Tell us by opening an issue in the repository, or write to us before publishing if you think it could affect someone. We answer, and we fix it.

The four checks you can run yourself