Security Statement

Last updated: 23 September 2026

YourPDF Checker is a product of Cardan International B.V. The security of YourPDF Checker is therefore covered by the Cardan security statement. It explains how Cardan protects information and how to report a vulnerability.

Read the Cardan security statement

Below you can read what this means in practice for YourPDF Checker.

Data in transit

All communication between your browser and our servers is encrypted using TLS 1.3. HTTPS is enforced on all endpoints. An unencrypted HTTP connection is automatically redirected to HTTPS.

Data at rest

Database backups are encrypted and stored in geographically separate locations within the EU.

Document handling

PDF documents you upload are processed in isolated, sandboxed environments on our own infrastructure. How long a document is kept is a setting your organisation controls: from deletion immediately after processing up to a maximum of 365 days. The default is 24 hours. On the Free plan, documents are never stored: they are removed shortly after processing, within two hours at the latest. Choosing a retention period is only available on the paid plans.

We never sell your documents, and we never make them available to third parties for their own purposes. One exception is worth naming: your organisation can allow AI-assisted checks. Where it has, the document being checked is sent to OpenAI for analysis, in whole or in part. OpenAI processes this as our processor and does not use it to train its models. Without that permission, no document content leaves our own infrastructure.

Infrastructure

Our servers are hosted in the European Union with ISO 27001 certified hosting providers. Storage and processing of your data take place within the EU. We use Cloudflare as our content delivery and security layer. Cloudflare terminates TLS connections at the edge location closest to the visitor, which may be outside the EU. The service providers we rely on are listed in our privacy statement.

Access control

Only authorised personnel have access to production systems. We use multi-factor authentication, give staff no more access than they need (the principle of least privilege) and record all administrative actions in audit logs.

Updates

We review this page at least once a year, and sooner when our security practices change materially.