Last updated: September 7, 2026
Only automated systems process your file content. PDFHaul staff do not access file contents except where legally required or to investigate critical abuse or security incidents.
No, not in the normal course of operation. The same narrow exceptions above apply: legal requirement, or investigating abuse or a security incident.
It's removed from active storage immediately. Even files you don't delete manually are automatically deleted from our active systems within approximately two hours of processing — see Zero Permanent Storage below for details.
All infrastructure runs on Google Cloud Platform in the us-central1 (Iowa, USA) region. Account data and file data are kept separate: account records (email, authentication) live in a managed PostgreSQL database, while the files you upload are held in isolated cloud storage buckets, cleared automatically per our retention policy.
PDFHaul is built with a privacy-first mindset. We understand that you trust us with your documents, and we design our systems to minimize data retention and reduce exposure wherever possible. Your files are processed automatically and deleted from our active systems after processing. We do not manually access file contents except where legally required or to investigate critical abuse or security incidents.
All communication between your device and PDFHaul is encrypted using HTTPS/TLS. We use Transport Layer Security with automatic SSL certificate management and renewal, modern and secure cipher suites, and HTTP Strict Transport Security (HSTS) to enforce encrypted connections at all times.
All temporary files and service data stored on our cloud provider are encrypted at rest using industry-standard encryption. This covers cloud provider-managed encryption keys, encrypted storage for temporary files, encrypted database backups, and secure secrets management.
PDFHaul runs on Google Cloud Platform, in the us-central1 (Iowa, USA) region, with SOC 2 Type II certified data centers, 24/7 physical security and monitoring, redundant power, networking and failover systems, DDoS protection and traffic filtering, and geographic redundancy for disaster recovery. File data and account data are stored separately: uploaded files live in isolated Google Cloud Storage buckets with the automatic deletion policy described below, while account records (email, authentication) are kept in a managed PostgreSQL database with automated daily backups.
Cloudflare sits in front of our infrastructure for DNS resolution and TLS termination, providing baseline DDoS mitigation at the edge. Our backend runs on Google Cloud Run in isolated, per-request containers behind a trusted proxy configuration, so the client IP addresses used for rate limiting and abuse detection cannot be spoofed. We conduct periodic internal security audits reviewed against the OWASP Top 10.
Every response is served with a strict Content-Security-Policy, HTTP Strict Transport Security (1-year max-age, applied to all subdomains, preload-enabled), and protections against clickjacking and MIME-sniffing, enforced via security headers middleware. State-changing requests are protected against CSRF using the double-submit cookie pattern. Every API request body is validated against a strict schema before it is processed, rejecting malformed or out-of-range input rather than trusting client-supplied values. Because all database queries go through an ORM's parameterized query builder rather than raw SQL, traditional SQL injection is not structurally possible. Requests are rate-limited by tier: general API access, uploads, and processing operations each have their own limits, and login attempts are strictly rate-limited to prevent brute-force attacks. Limits are keyed to the authenticated user or a normalized IP address so they cannot be bypassed by IPv6 address rotation.
Files are temporarily stored during processing and are automatically deleted from our active systems within approximately two hours. Temporary processing files are removed immediately after use. We do not permanently store user files.
Every uploaded file is checked against its declared type and its actual binary signature before processing. A renamed file cannot bypass validation just by changing its extension or content-type header. PDFs are bounded in size and page count, with a processing timeout, to prevent PDF-bomb-style resource exhaustion. On load, embedded JavaScript and auto-execute actions are stripped from a PDF's internal structure before any further processing touches it. All file paths are validated to stay within their designated storage location before any read or write, blocking path traversal attempts and symlink-based access. Features that import a file from a URL you provide (our MCP server, and cloud-storage connectors) validate the target address first: private and reserved IP ranges are blocked, and the resolved IP is re-checked after DNS lookup to prevent DNS-rebinding attacks. All processing runs in isolated, sandboxed containers.
Our cloud provider may retain low-level storage remnants such as block-level snapshots for a short period for reliability purposes. These remnants are not accessible to PDFHaul and are covered by the cloud provider's own security and privacy commitments.
PDFHaul aligns with PIPEDA (Canada), GDPR-aligned practices (EU), CCPA/CPRA-aligned practices (California), and OWASP Top 10 principles. We don't currently hold formal certification such as SOC 2 or ISO 27001 — our practices are built around these frameworks in the meantime, and formal certification is on our roadmap as we scale.
We use a dedicated error-tracking service for real-time exception monitoring, and log security-relevant events such as rate-limit violations and authentication failures in a structured format for review. We conduct periodic internal security audits reviewed against the OWASP Top 10. We have an established incident response process covering rapid investigation and mitigation, and we notify affected users where required by law.
User passwords are hashed with bcrypt before storage; PDFHaul never stores or has access to a user's plaintext password. Internal automated operations are authenticated using cryptographically signed, non-transferable identities rather than static credentials that could be copied or leaked. The automated system responsible for deleting expired files from storage is restricted to delete-only access and cannot read file contents.
If you discover a security vulnerability, please report it responsibly. Provide a clear description of the issue with steps to reproduce, do not access or modify user data, do not perform actions that could disrupt the Service, and allow us reasonable time for remediation.
To report a vulnerability, email: [email protected]
You can help protect your account by using a strong and unique password, enabling two-factor authentication when available, keeping your devices and browser updated, avoiding uploads of highly sensitive or regulated documents, being cautious of phishing attempts, and logging out on shared devices.