Security
How we keep your documents and account safe — the practices we follow today and the certifications we are working toward.
Encryption
TLS in transit. AES-256 at rest. File contents are encrypted with per-tenant keys, managed in a cloud key-management service with automatic rotation.
Infrastructure
Hosted on isolated virtual networks per environment. Production access is SSO + hardware-key-gated for a small, audited group of engineers.
Compliance (in progress)
SOC 2 Type II readiness in progress. We follow the GDPR framework for EU/UK data subjects. HIPAA BAA will be made available on Studio plans once our compliance review is complete.
Secure SDLC
Every PR is reviewed and passes static analysis, dependency scanning, and secret detection before merge. We plan to engage third-party pen-testers annually and publish summaries as they become available.
Incident response
On-call rotation in place. Customers will be notified promptly and in line with applicable laws in the event of a confirmed breach affecting their data.
Report a vulnerability
Responsible disclosure is welcomed at support@pdfcraftai.com. A formal bounty program is in development.
Questions about this document? Email support@pdfcraftai.com.