Security is important for us. We use SSL and TLS security and file encryption at rest to protect your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure.
- Application Security Features
- Data Transmission
- Data Encryption
- Data Security
- Physical Security
- Credit Card Information
- Data Deletion
PDF.co API Platform Security Features
Our API (Application Programming Platform) includes the following security features:
- Detailed logs for every API calls. Logs include the following data: API endpoint, user agent, IP address, copy of the request, and response. Sensitive data such as passwords are automatically redacted from logs. The log retention period may vary depending on your subscription plan;
- Access to API logs, files, templates is locked for view by the user only. Optional access for tech support purposes can be temporarily enabled by a user;
- Uploaded and generated files are stored under highly randomized file names;
- Generated files are permanently removed within 1 hour automatically. The expiration period may be decreased or increased up to 24 hours if needed for specific files;
- API functions for forced output file removal are available;
- Built-in secure permanent file storage provides a way to store documents, images, and other files for re-use in API. Files from this storage are available for re-use in PDF.co API only;
- Functions to open encrypted and password-protected PDF files;
- Functions to apply password protection and encryption to PDF files;
- IP allow list to restrict access to API and/or UI from predefined IP addresses only;
- Single-sign on (SSO) setup Single Sign On (SSO, SAML). SSO mitigates compliance and security risks for organizations by giving businesses control over user authentication and user revocation via corporate-mandated tools;
- History of Logins new new – the history of recent logins is available for review for every log: IP address, user agent, date and time for every login session.
The availability of selected features may vary depending on your subscription plan.
Security is important for us. We use forced SSL and TLS security and file encryption at rest to protect your data. Our servers are hosted on the world-class infrastructure at Amazon AWS to keep your data safe and secure.
We do not use 3rd party API to process your documents, except for the following API functions:
Your connections to application and API require Transport Layer Security Secure (TLS) and Secure Sockets Layer (SSL), cryptographic protocols designed to provide communications security over a computer network. Encryption is used to ensure a high level of security and privacy. When you upload documents and files, they are transmitted via encrypted connections.
Your files are stored behind a firewall and authenticated against the sender’s session every time a request for that file is made. We enforce the use of industry best practices for the transmission of data to our platform (Transport Layer Security TLS) and data is stored in SOC 1 Type II, SOC 2 Type I, and ISO 27001 certified data centers. Your documents are stored and encrypted at rest using AES 256-bit encryption.
When a file is generated by our server, it is stored under a random name and is permanently removed after 1 hour (until you set a longer storage period explicitly). Generated files can also be removed permanently using /file/delete API method at any time.
Servers and data are hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:
- ISO 27001
- SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
- PCI Level 1
- FISMA Moderate
- Sarbanes-Oxley (SOX)
- AWS also provides an environment that enables businesses to comply with HIPAA regulations
PDF.co utilizes ISO 27001, FISMA, HIPAA certified data centers managed by Amazon. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, and critical facilities have extensive setback and military grade perimeter control berms as well as other natural boundary protection. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state-of-the-art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.
Amazon only provides data center access and information to employees who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical and electronic access to data centers by Amazon employees is logged and audited routinely.
For additional information see: https://aws.amazon.com/security
Credit Card Information
PDF.co does not store your credit card information. When you submit your credit card information, it is passed to our payments processor Stripe, a PCI Service Provider Level 1 service, or to FastSpring (BrightMarket LCC, USA), our authorized reseller.
Upon request, PDF.co will work to expunge all customer data and solely owned documents from our systems. You can always delete your account from your profile page. Contact us if you need assistance with data deletion.
last updated August 15, 2021