Security

• Some work never leaves your device. Viewing pages, reading a PDF’s existing text, and the editing you do before you save all happen in your browser.
• Files that need our servers are uploaded with industry-standard encryption in transit.
• Each file is processed in isolation from other users’ files.
• File type and size are checked before processing.
• Every uploaded file is scanned for malware on our own servers, and scripts and other active content are removed from PDFs before processing.
• Text recognition runs on our own servers. Scans are not sent to an outside recognition service.
• Your file stays on our server only for a short time while it is processed, then it is deleted. Tools that work in several steps keep it for up to 30 minutes after you last use it. Request Signatures deletes documents 30 days after the request is finished.

The Privacy Policy gives the full details.

• Passwords are stored only in a strongly hashed form using an industry-standard algorithm. We never store the password itself.
• Session tokens are also stored only in hashed form.
• Our cookies are secured so that page scripts cannot read them.
• Signing out ends your session on our servers straight away.
• Resetting your password signs you out on every device.
• For security reasons, after several failed sign-in attempts in a row, the account is locked for a short time. We also limit how many requests can be made to the service.

• Use a password you do not use anywhere else.
• Sign out when you use a shared or public computer.
• Keep your original files. KovaPDF is not a backup service.
• Be careful with emails that claim to be from us. We will never ask for your password, or ask you to send a document by reply.

If you find a security flaw, email support@kovapdf.com with the page or endpoint, the steps to reproduce it, and what you were able to do.

We will:

• reply within 5 working days;
• tell you what we found and when we expect to fix it;
• tell you when it is fixed, and credit you if you wish;
• not take legal action against research done within the rules below.

We ask you to:

• test only with your own account and files, and stop and tell us if you reach anyone else’s data;
• not disrupt the service, for example with denial-of-service attacks or heavy automated scanning;
• give us reasonable time to fix the issue before you publish it. Our default is 90 days.

If a security breach affects your data, we will tell you promptly, explain what happened and what was involved, and say what you should do.