Security

1. Signing in

• You can sign in with a password, an emailed code or sign-in link, Sign in with Google, or a passkey.
• Passwords are stored only as a bcrypt hash. When you choose a password, we check it against known breached passwords using a range query: only a short prefix of a one-way hash of the password leaves our systems, never the password itself. A breached password is refused.
• Two-factor sign-in with an authenticator app is available to everyone, with recovery codes. It is required for our administrators.
• Sign-in codes and sign-in links expire after 10 minutes and work once. Password reset links expire after 30 minutes.
• We email you when your account is signed in from a new device or browser, so that you can act at once if it was not you.
• A session stays signed in for 30 days of use and never longer than 90 days, after which you sign in again. The session cookie cannot be read by scripts on the page.
• Sign-up and sign-in forms are protected by a bot protection service and by rate limits.

2. Keeping accounts apart

Every document, template, signature request and record belongs to one account, and every request is checked against that account and against your role in it. We test this by attacking our own service from a second account and from a member without the right role. A private document can be opened only by its creator; the owner and admins of a team account cannot open it. A member removed from an account loses access immediately, including on devices that are already signed in.

3. Your files

• Every upload is scanned for viruses, and its type is checked from its content, not its name.
• Files are processed in isolated environments with no network access, limited resources and a fresh working area for each job, which is deleted afterwards.
• Scripts and embedded files inside a PDF are never run.
• Uploaded inputs are deleted when the job ends, and results you do not save are deleted after 2 hours.
• File storage is private. Download links are signed, work only for your account, and expire after 5 minutes.
• Document content, file names, email addresses and sign-in codes are kept out of our logs, error reports and analytics.
• Document content is sent to an AI model provider only when you run an AI tool, under terms that forbid training on it or keeping it.

4. Encryption

All traffic to PDF Loft is encrypted in transit with TLS 1.2 or later, and browsers are told to use only secure connections. Stored data and backups are encrypted at rest. Particularly sensitive values, such as authenticator secrets, connection tokens and signing keys, are also encrypted individually. Sign-in codes and tokens are stored only as hashes.

5. Payments

Card and bank details are entered with our payment processors and never pass through or rest on our servers. Prices and plans are decided on our servers, never in your browser, and every notification from a payment processor is checked for a valid signature before we act on it.

6. How we operate

• Staff and services have only the access they need. Our database is not reachable from the internet.
• Administrators sign in with two-factor authentication. When they need to look at an account to help you, they see only metadata such as names, sizes, dates and status, in a read-only view that is logged. They cannot open document content.
• Every change to our code passes automated security checks, including scans for leaked secrets and for known vulnerabilities in the software we depend on, before it can be released.
• We test the service against the common classes of web attack, and fix what we find before release.
• If a breach affects your personal data, we notify you and the relevant authorities as the law requires.

We do not claim any security certification, and we do not promise that any service is free of every vulnerability. We describe here what we do, and we will keep this page accurate as our practices change.

7. What you can do

• Use a passkey, or turn on two-factor sign-in.
• Use a password you do not use anywhere else.
• Keep documents private unless the whole account needs them.
• Remove members who no longer need access.
• Change your password at once if you receive a new sign-in email you do not recognise.

8. Reporting a security problem

If you believe you have found a security vulnerability in PDF Loft, email contact@wrxstack.com with "Security" in the subject. Describe the problem and the steps to reproduce it. We will acknowledge your report, keep you informed while we investigate, and tell you when it is fixed.

While you investigate, please use only accounts you own or have permission to test, do not access, change or delete other people's data, do not degrade the service for others, and give us reasonable time to fix the problem before you disclose it. We will not take legal action against research carried out in good faith within these rules.