Security Policy
How the Service is designed
- Local processing: documents are processed in your browser and never uploaded, so there is no central store of user files to breach.
- Encryption in transit: the site is served only over HTTPS.
- Self-hosted code: the libraries and fonts that run the tools are served from our own domain, not loaded from third-party code hosts.
- Strong PDF encryption: Protect PDF uses AES-256 and never sends your password anywhere.
- Minimal data: no accounts, no passwords stored, no document data collected.
Reporting a vulnerability
Please email support@havardsolutions.com with the subject “Security”, a description of the issue, steps to reproduce it and its impact. We’ll acknowledge your report within 3 business days and keep you updated until it’s resolved.
Safe harbor
We won’t pursue legal action against good-faith research that: avoids privacy violations and service disruption, only tests against your own data, doesn’t use social engineering or denial-of-service attacks, and gives us reasonable time to fix the issue before public disclosure. We don’t currently offer paid bounties, but we’re glad to credit researchers who want it.
Machine-readable contact details are in security.txt.