Trust
Security at PDFWhirl
Implementation summary reviewed: 13 July 2026
This page describes controls visible in the repository. It is not a certification, audit report, guarantee, or substitute for the site owner’s operational security review.
Transport and browser protections
The production frontend points to an HTTPS API domain. Frontend hosting and the API gateway configure transport and browser security headers, including HSTS and content-type, framing, referrer, and content-security controls.
Deployment infrastructure
PDFWhirl's application services are hosted on Railway. Cloudflare services support site delivery, and Cloudflare R2 provides object storage. This is a description of the current deployment providers, not a security certification or availability guarantee.
Authentication and access
Accounts use password hashing and signed bearer tokens. The gateway validates signed-in requests and supplies identity context to internal services. Some public tools also support anonymous guest access, so an anonymous session should not be treated as a private account boundary.
File transfer and storage
The browser uploads selected inputs through the file service. The service creates time-limited signed download URLs and signed upload URLs for worker-generated outputs in configured R2-compatible object storage. File type, content signature, and size validation are implemented for supported input uploads.
Processing boundaries
Jobs are routed to separate PDF and conversion workers. Workers use temporary directories and attempt cleanup after each job. Stored files remain separate from those temporary workspaces and do not have a verified automatic deletion schedule.
Service controls and logging
The gateway includes request-size checks, rate limiting, CORS rules, and security headers. Services emit operational logs and job events. Production access, monitoring, backup, secret rotation, and log-retention procedures cannot be fully verified from application code alone.
User responsibilities
Keep original files, use strong unique passwords, review outputs, avoid uploading files you are not authorized to process, and delete stored files when you no longer need them where that control is available.
Report a vulnerability
Email support@pdfwhirl.com with the subject “Private security report.” Do not post exploit details or sensitive data in the public issue tracker. Do not include active secrets or user documents in the initial report.
Related information
Read the Privacy Policy for data-handling details or visit the Contact page for current contact limitations.