Security

Security is important for us. We use SSL and TLS security and file encryption at rest to protect your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure.

PDF.co API Platform Application – Security Features

PDF.co Status Page is here: https://pdf.co/status PDF.co platform’s security features:
  1. Temporary files are stored on the cloud storage with a strong encryption at rest;
  2. API logs are generated for a user.
    • API logs details visible to tech support and service administrator:
      • Datetime
      • Job ID (if any)
      • API endpoint
      • User-agent (if was provided)
      • Credits spent on API call
      • Response Status code
    • Passwords, remote access usernames and passwords are auto-redacted before saving API and application logs;
    • Special “Strict API logging” is available for working with a sensitive data. In this mode
      • input parameters and output parameters is auto-redacted before writing into logs so they are not visible even to a user. In other words, in this mode all input links, input and output parameters are always redacted from API logs.
    • API logs retention period:
      • from 1 hour to 60 days depending on selected subscription plan;
  3. Access to API logs, files, html templates, document parser templates is available to
      • Account user
      • Temporary access (48 hours) can be opened to PDF.co tech support only if user explicitly enabled 48-hours temporary access. Access is auto-removed after 48 hours automatically.
  4. Documents and data is processed in memory when possible
    1. document processing engine is designed to maximize use of in-memory processing. Internal file system is used only when required, for example, for processing large pdf files or images;
    2. servers are regularly reset and replaced to new servers;
  5. Generated output files are securely stored and removed
    • output files are stored under highly randomized urls;
    • files are encrypted at rest while stored in the cloud storage;
    • files are automatically removed in 1 hour by default (can be adjusted from 1 min to 3 days using expiration parameter);
    • files can be also removed using file/delete API method;
  6. API functions for forced output file removal are available;
  7. PDF.co provides built-in secure permanent file storage
    • store documents, images, pdf templates and other files for re-use in API
    • files from the storage are available via randomly generated file tokens
    • available only for use inside PDF.co API via special filetoken:// protocol
  8. Password-protected input pdf files are supported
    • use password parameter to include password to open protected pdf file
    • pdf.co provides endpoints with the following functions to process pdf files:
      • disable or enable printing
      • disable or enable copying of content
      • add or remove user or owner password
      • add or remove document permissions (printing, data extraction, merging)
      • add digital signature
  9. Can read input files protected with HTTP authentication
    • use httpusername and httppassword for http based authentification (via https) protocol;
  10. User Controlled Data Encryption (AES encryption) for input and output files
    • Automatically encrypt output files with strong AES encryption;
    • Automatically decrypt input files previously encrypted with AES encryption;
    • Supported AES encryption types:
      • 128-bit
      • 192-bit
      • 256-bit
    • User-controlled encryption parameters are supported by all endpoints that read input or writing output file;
    • Can decrypt input file and encrypt output file simultaneously. For details please check this KB article
  11. Allowed IP list to restrict access to API and/or UI to a set of IP addresses only;
  12. Single-sign on (SSO, SAML).  SSO mitigates compliance and security risks for organizations by giving businesses control over user authentication and user revocation via corporate-mandated tools;
  13. History of Logins  – the history of recent logins is available for review inside API logs and includes IP address, user agent, date, and time for every login session.
The availability of specific security features may vary depending on your subscription plan.

Data Transmission

Security is important for us. We use forced SSL and TLS security and file encryption at rest to protect your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure. We do not use 3rd party API to process your documents, except for the following API functions:
  • PDF Translation API: plain text extracted from your PDF is translated via AWS Translate. Your plain text data may be the subject of the Terms of Use of Amazon Translate (AWS Translate).

Data Encryption

Your connections to application and API require Transport Layer Security Secure (TLS) and Secure Sockets Layer (SSL), cryptographic protocols designed to provide communications security over a computer network. Encryption is used to ensure a high level of security and privacy.  When you upload documents and files, they are transmitted via encrypted connections. Your permanent files are stored behind a firewall and authenticated against the sender’s session every time a request for that file is made. We enforce the use of industry best practices for the transmission of data to our platform (Transport Layer Security TLS) and data is stored in SOC 1 Type II, SOC 2 Type I, and ISO 27001 certified data centers at Amazon AWS cloud. Your documents are stored and encrypted at rest using AES 256-bit encryption. When a file is generated by our server, it is stored under a randomized name to provide a unique link which is not possible to guess. Then the file is permanently removed after 1 hour by default. Generated files can also be removed right away using a /file/delete API method at any time.

Data Security

Servers and data are hosted and managed within Amazon’s secure data centers (US West 2 region) and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:
  • ISO 27001
  • SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
  • PCI Level 1
  • FISMA Moderate
  • Sarbanes-Oxley (SOX)
  • AWS also provides an environment that enables businesses to comply with HIPAA regulations

Physical Security

PDF.co utilizes ISO 27001, FISMA, HIPAA certified data centers managed by Amazon. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, and critical facilities have extensive setback and military grade perimeter control berms as well as other natural boundary protection. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state-of-the-art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. Amazon only provides data center access and information to employees who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical and electronic access to data centers by Amazon employees is logged and audited routinely. For additional information see: https://aws.amazon.com/security

Security Frameworks

SOC 2 compliance (in work, expected in 2022):
  • ByteScout, Inc. (d/b/a PDF.co) is in the process of implementation of SOC 2 and plan SOC 2 Type 1 examination, followed by the SOC. Contact us for more information
  • PDF.co runs on SOC 2 compliant data centers provided by Amazon AWS (see Data Security and Physical Security above)
HIPAA compliance:
  • HIPAA compliance security is available for
    • Dedicated API Server (managed hosted private API server hosted on Amazon AWS);
    • On-Prem API Server (self-hosted in your own private cloud or your company’s infrastructure);
  • Encryption support:
    • pdf/security/add and pdf/security/remove endpoints providing support for adding password to PDF, setting up security permissions.
    • all endpoints include password parameter for reading password protected pdf files;
    • User-controlled data encryption (AES 128, AES 192, AES 256) and AES decryption are available for auto-encrypting output files and auto-decrypting input files and documents. Security options are compatible with the leading online platforms to support reading of documents and files encrypted by 3rd party apps and platforms;
  • PDF.co (cloud API platform). HIPAA compliance is in currently in work.

Credit Card Information

PDF.co does not store your credit card information. When you submit your credit card information, it is passed to our payments processor Stripe, a PCI Service Provider Level 1 service, or to FastSpring (BrightMarket LCC, USA), our authorized reseller.

Data Deletion

Upon request, PDF.co will work to expunge all customer data and solely owned documents from our systems. You can always delete your account from your profile page. Contact us if you need assistance with data deletion. last updated January 24, 2022