How we look after your files and your account
Where your documents go, how long they stay, how they are encrypted, and who can reach what. Written plainly, and kept in step with how the service actually works.
- Deleted after the jobFiles are not kept once your result is ready
- Many tools never uploadThey run in your browser
- TLS 1.2 and 1.3 onlyOlder versions are refused
- Encrypted backupsEvery 6 hours, tested monthly
Your files: where they go and when they are deleted
We do not keep copies of your documents. A file sent to our servers is held only for as long as the job needs it.
| What happens | How long the file stays |
|---|---|
| Tools that run in your browserThe file stays on your device | Never uploaded |
| Most server toolsCompress, convert, the PDF editor’s save and others | Deleted as soon as the result is sent, whether the job worked or not |
| Tools that work in several stepsSmartShrink, Redact PDF, PDF to PDF/A and Repair PDF | Deleted 30 minutes after you last use it, and never kept longer than 3 hours |
| A job cut shortFor example by a server restart | Removed by an automatic clean-up once it is 1 hour old. The clean-up runs every 10 minutes. |
| Request SignaturesDocuments you send out for signing | Kept while the request is open, then deleted 30 days after it is finished, declined, expired or cancelled |
| Summarize PDFThe file is read in your browser | Only the text needed for the summary is sent to an AI text-processing provider. We do not store the text or the summary. |
Every upload is checked for viruses before any tool opens it, and scripts and other active content are removed from PDFs. We do not review what is in your files, and we do not use them to train any model. The Privacy Policy has the full details.
What runs in your browser, and what runs on our servers
In your browser
These tools do the work on your own device. The file is never sent to us.
- Merge, split, rotate, resize, crop and organize pages
- Delete pages, add blank pages, page numbers, watermark, header and footer
- PDF to JPG or PNG, and JPG or PNG to PDF
- Protect and unlock PDFs
- Text and CSV to PDF
- Image to Text and PDF to Text
- Resize Image, and the Bijoy and Kruti Dev converters
- PDF to Word and PDF to Excel, when the PDF has no pictures
- Viewing and editing in the PDF editor, until you save
On our servers
These need our servers. The file travels encrypted, is worked on in isolation from other people’s files, and is deleted as shown above.
- Saving your changes in the PDF editor
- Compress PDF and SmartShrink
- Word, Excel, PowerPoint and other office files to PDF, and PDF to PowerPoint
- PDF to Word and PDF to Excel for PDFs with pictures
- PDF to PDF/A, Repair PDF and Redact PDF
- Digital signatures and Request Signatures
Encryption
How your data is protected on its way to us, while it is with us, and in your account.
- TLS 1.3
- AES-256
- Argon2id
- HSTS
- PBKDF2-SHA256
- TOTP (RFC 6238)
In transit
Every connection to KovaPDF uses TLS 1.3 or TLS 1.2. Older versions, TLS 1.0 and 1.1, are refused.
Browsers that support it get a hybrid post-quantum key exchange (X25519 with ML-KEM-768). Our API accepts only forward-secret, authenticated ciphers.
Traffic is encrypted again from our network edge to our servers, and HSTS (two years on the website, 180 days on the API) keeps browsers on HTTPS.
The database cannot be reached from the internet. Only our own API talks to it, over a private network inside the same server, so that traffic never crosses the public internet.
At rest
Files you upload are processed in memory-backed temporary storage and deleted after each job. They are not written to our servers' disks.
Our database runs on our own server, not on a third-party database service. The server's disks, database included, are encrypted at rest with 256-bit AES (AES-256) by our hosting provider.
Backups
Database backups are encrypted with AES-256 before they leave the backup job, with a key derived using PBKDF2-SHA256 and 600,000 iterations. The passphrase is kept apart from the backups.
Each copy is checked with a SHA-256 checksum after upload and kept for up to 30 days, so a deleted signature document can stay in a backup for up to 30 days.
On top of that, every change is copied within a minute, encrypted with AES-256, to storage kept apart from our servers. This lets us bring the database back to any moment in the last 7 days.
Accounts and passwords
Passwords are hashed with Argon2id, using 64 MiB of memory, 3 passes and a unique random salt. We never store the password itself.
Sessions use 256-bit random tokens that we keep only as SHA-256 hashes, in cookies that page scripts cannot read.
Two-step sign-in
Two-step sign-in uses standard time-based codes (TOTP) from any authenticator app. Each secret is encrypted with AES-256-GCM, using a key that is not stored in the database.
Recovery codes work once and are stored only as hashes.
Payments
Card payments are handled by our payment partner on its own secure checkout. Your card number goes straight to them over an encrypted connection.
We never see, receive or store card numbers.
Accounts and sign-in
Passwords
Stored only as a strong one-way hash. After 10 wrong passwords in a row the account is locked for 15 minutes. Resetting your password signs you out everywhere.
Two-step sign-in
Every account can add a code from an authenticator app, with recovery codes for a lost phone. Business admins can make it required for everyone in their workspace.
Sign in with Google
You can sign in with Google instead of a password. A Business workspace that verifies its company domain can ask its people to sign in that way.
Payments
Handled by our payment partner
When you buy a plan, you pay on our payment partner’s own secure checkout. Your card number goes straight to them. It never reaches our servers, and we never see or store it.
What we keep
- Which plan you have, and until when
- Whether a payment went through
- A reference to look up a receipt
Refunds are covered in the Refund Policy.
Backups
Account data is copied so it can be brought back if something goes wrong. Files you upload to a tool are not in backups, because we do not keep them. Documents in signature requests are, and one that is deleted leaves the last backup within 30 days.
Every 6 hours
A full copy of the database, taken on our server and encrypted there before it is uploaded.
Encrypted, kept apart
Encrypted before it is stored, away from our servers and the database. Copies are kept for 7 days, and one a day for 30 days.
Restore tested
Once a month a backup is restored into a fresh database automatically, and its tables are counted.
Access for our staff
Two locks on the admin side
- The admin panel asks for a one-time code, sent to an approved address, before our own sign-in page even opens
- Then an admin account and its password; two-step sign-in can be made compulsory for every admin
- Support staff see only the parts of the admin panel their role allows
- Changes to accounts and settings are written to an audit log
What staff cannot see
- Your files: they are not kept, so there is nothing to open
- Your password or two-step secret: only hashes and encrypted values are stored
- Your card number: it never reaches us
- A team’s group chat: the admin panel has no way to read it
Your data, your choice
Delete your account
You can delete your account yourself from Account › Security. Your account, its sessions and its sign-in links are removed. Usage records stay only as anonymous counts that no longer point to you.
Ask for a copy or a correction
Email [email protected]. The Privacy Settings page lists every control you have, and the Privacy Policy explains what we keep and why.
Found a security problem?
Email [email protected] with the page, the steps to reproduce it and what you could do. Our security policy says how we handle reports and what we ask of you.