Your files never leave your device. Here's how that actually works.

"Secure" is a claim every file tool makes. This page explains the difference between how most online PDF tools handle your documents and how PilotPDF does — and shows you how to verify our claim yourself instead of taking our word for it.

What happens on a typical online PDF site

When you use a conventional online converter, your file makes a round trip: it is uploaded to the company's servers, processed there, stored at least temporarily, and the result is sent back to you. During that trip your document exists on infrastructure you don't control, subject to that company's retention policies, staff access rules, subprocessors, and security posture. Most reputable services delete files within hours — but you are trusting them to do so, and a breach, bug, or subpoena during the window is out of your hands.

For a meme or a flyer, that trade-off is usually fine. For contracts, payslips, medical records, IDs, and unreleased financials, many people — and many company policies — say no. That's the gap PilotPDF is built for.

What happens on PilotPDF instead

When you open a PilotPDF tool, your browser downloads the processing engine itself — compiled to WebAssembly, a fast, sandboxed binary format that all modern browsers run. When you then choose a file, it is opened directly in your device's memory. Merging, compressing, converting, OCR — all of it executes on your own CPU, inside the browser's sandbox. The finished file is written straight to your Downloads folder.

There is no upload step to skip retention on — the architecture has no server-side processing at all. We cannot read, store, scan, or lose your documents, because they never reach us. This is what "privacy by design" means: the guarantee comes from how the system is built, not from a promise in a policy document.

Don't trust us — verify it

Two checks anyone can do, no technical background needed:

1. Watch the network. Open your browser's developer tools (F12), switch to the Network tab, then use any tool on this site. You'll see the page and its engine load — and then nothing leaving your machine when you process a file. On a conventional converter, this is where you'd watch your document upload.
2. Pull the plug. Load a tool, then disconnect from Wi-Fi or enable airplane mode. Process your file. It works — because nothing needed the internet after the page loaded. A server-based tool fails this test instantly.

Honest limits of this model

Client-side processing means your device does the work. Very large files are bounded by your machine's memory — we recommend files under 100MB, and under 20MB for the smoothest experience on older hardware. And as with any website, the page itself is delivered over the network; standard analytics tell us which pages are visited (never anything about your files, which the analytics cannot see).

We think that trade is worth it: slightly less convenience on giant files, in exchange for a structural guarantee that your documents stay yours.

Questions about how this works? Get in touch — or read our privacy policy for the formal version.