Trust
Security at PDFWhirl
Implementation summary reviewed: 23 September 2026
This page describes controls visible in the repository. It is not a certification, audit report, guarantee, or substitute for the site owner’s operational security review.
Transport and browser protections
The production frontend points to an HTTPS API domain. Frontend hosting and the API gateway configure transport and browser security headers, including HSTS and content-type, framing, referrer, and content-security controls.
Deployment infrastructure
PDFWhirl's application services are hosted on Railway. Cloudflare services support site delivery, and Cloudflare R2 provides object storage. This is a description of the current deployment providers, not a security certification or availability guarantee.
Authentication and access
Accounts use password hashing and signed bearer tokens. The gateway validates signed-in requests and supplies identity context to internal services. Some public tools also support anonymous guest access, so an anonymous session should not be treated as a private account boundary.
File transfer and storage
The browser uploads selected inputs through the file service. The service creates time-limited signed download URLs and signed upload URLs for worker-generated outputs in configured R2-compatible object storage. File type, content signature, and size validation are implemented for supported input uploads.
Processing boundaries
Jobs are routed to separate PDF and conversion workers. Workers attempt to remove per-job temporary directories after processing. This does not delete stored input or output objects. Stored input and output objects are deleted automatically: files uploaded without an account are removed about 24 hours after upload, and files belonging to a signed-in account are removed after 7 days. A scheduled sweep enforces this hourly against the object store itself.
Service controls and logging
The gateway includes request-size checks, rate limiting, CORS rules, and security headers. Services emit operational logs and job events. Production access, monitoring, backup, secret rotation, and log-retention procedures cannot be fully verified from application code alone.
User responsibilities
Keep original files, use strong unique passwords, review outputs, avoid uploading files you are not authorized to process, and use the published privacy request channel when you need help requesting deletion of stored files.
Report a vulnerability
Email support@pdfwhirl.com with the subject “Private security report.” Do not post exploit details or sensitive data in the public issue tracker. Do not include active secrets or user documents in the initial report.
Related information
Read the Privacy Policy for data-handling details or visit the Contact page for current contact limitations.