How ACE PDFMD protects your files, your account, and your payment details.
All traffic to and from ACE PDFMD, including file uploads and downloads, is encrypted using HTTPS/TLS.
Client-side tools (Merge, Split, Rotate, Crop, Watermark, and others) process your file entirely in your browser โ it is never uploaded anywhere. Server-processed tools write your file only to temporary, in-memory storage on our servers, and it is deleted automatically โ normally the instant your result finishes streaming to you, and always within 60 minutes at the absolute latest as a backstop, even if a request is interrupted or you never come back to download it.
Lemon Squeezy is our Merchant of Record for all Pro subscriptions. Card numbers, billing addresses, and other payment details are entered directly on Lemon Squeezy's secure checkout and are never transmitted to, processed by, or stored on ACE PDFMD's servers.
Passwords are never stored in plain text โ they are hashed using PBKDF2-HMAC-SHA256 with a unique salt per account. Login sessions use a cryptographically signed token that cannot be forged or tampered with client-side.
Uploaded files are checked against their claimed file type (magic-byte signature checking) before processing, filenames are sanitized, and both per-request and per-day upload limits are enforced, to block malicious or abusive uploads.
Our backend runs on Google Cloud Run, a managed, auto-scaling container platform. Admin controls are protected by a secret key using constant-time comparison to prevent timing attacks. Security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) are sent on every response.
We never use uploaded files, generated outputs, or their contents to train any machine learning or AI model, and no third-party AI API is used to process your documents at all.
If you believe you've found a security vulnerability, please email contact@acepdfmd.com with details โ we take these reports seriously and will respond promptly.