Think about the last five PDFs you edited. There is a good chance the list includes something you would not post publicly: a signed contract, a payslip, a passport scan for a visa application, a medical form, a tax document, a lease with your address on it.
Now ask the question most people never ask: when you dragged that file into an online tool, where did it go?
Server-side editing: what actually happens
Most online PDF tools work by uploading. Your file travels to the provider's server, the processing happens there, and you download the result. This is a perfectly ordinary architecture — it is how most web applications work, and it lets a provider offer heavy features like OCR and format conversion that would be impractical in a browser.
It also means your document exists, at least briefly, on infrastructure you do not control. That has consequences worth being clear-eyed about rather than alarmist:
- The file sits in someone else's storage. How long depends on the provider's retention policy. Reputable services delete uploads within a stated window — commonly an hour to a day — and say so in their privacy policy. Less reputable ones are vague.
- Retention policies are promises, not physics. A stated deletion window is a commitment from a company. It is not a technical guarantee, and it does not survive a backup system that quietly kept a copy.
- A breach reaches your documents. If the provider is compromised, whatever was in storage at that moment is in scope. You will typically learn about this months later, if at all.
- Employees may have access. Support staff resolving a failed conversion often can view the file that failed.
- The provider's terms may permit more than you assume. Some free services reserve broad rights over uploaded content. Most people accept these terms without reading them.
- Jurisdiction follows the server. A file processed abroad may be subject to legal access requests under laws that do not apply where you live — a real consideration for anyone handling client, patient, or employee records.
None of this makes server-side tools illegitimate. It makes them a trade: you exchange a copy of your document for a capability. The problem is that most people never realise they are making the trade.
In-browser editing: the alternative
Client-side, or in-browser, editing does the work on your own machine. There is no upload because there is no server-side processing step. This is how Docento.app is built.
The mechanism, concretely: when you open a PDF, your browser reads it into memory with the standard File API. It is rendered to a canvas by PDF.js, Mozilla's open-source renderer — the same engine Firefox uses to display PDFs. Your edits are written back into the document by pdf-lib. Both are JavaScript libraries executing on your device. When you export, the finished file is assembled in memory and handed to your browser's download mechanism.
Every one of those steps happens between your CPU and your screen. There is no request carrying your document anywhere, because there is no endpoint to carry it to.
How to verify this yourself
You should not take a privacy claim on faith, least of all from the company making it. Two checks, neither requiring technical expertise:
The network check. Open your browser's developer tools (F12 in most browsers, or right-click → Inspect), switch to the Network tab, then load a PDF into the editor and export it. You will see the page's own assets load — scripts, fonts, styles — and you will not see your document leave. A tool that uploads makes this obvious: there will be a request whose size matches your file.
The offline check. Load the editor page, then disconnect from the internet — turn off Wi-Fi, unplug the cable, enable airplane mode. Now open a PDF, edit it, and export. With in-browser processing, everything still works, because nothing needed the network. A server-side tool fails immediately at the upload step. This is the more convincing test of the two, and it takes thirty seconds.
What in-browser editing does not protect you from
Honesty about limits is the difference between a security property and a marketing slogan.
- It says nothing about analytics or advertising. This site uses both, and they are covered in our Privacy Policy. Those systems see that a page was visited; they do not see your document, because your document never enters the request path.
- Your device is still your responsibility. Malware, a compromised browser extension with page access, or someone reading over your shoulder are all outside what any web tool can defend against.
- Exported files live in your filesystem. A signed contract in a shared Downloads folder on a shared computer is exposed, regardless of how privately it was created.
- What you do next matters more than the edit. Emailing a sensitive PDF unencrypted sends it through several mail servers. In-browser editing protects the editing step, not the sending step.
- It cannot recover anything for you. We have no copy of your file. If you lose it, we cannot help — that is the direct cost of the design.
Choosing sensibly
For a birthday invitation, server-side is fine and the extra features may be worth it. For a signed employment contract, a client's financial records, a medical form, or anything covered by GDPR, HIPAA, or a professional confidentiality obligation, the calculation changes — and for regulated data, "we delete after an hour" may not satisfy your obligations at all.
Some practical questions to ask of any online PDF tool:
- Does it upload? (Run the offline check.)
- If it does, what is the stated retention period, and is it in writing?
- Where are the servers, and under whose jurisdiction?
- What do the terms of service claim about your content?
- Is there a privacy policy that names its third parties?
A tool that cannot answer these clearly has told you something useful.
The short version
The safest place for a confidential document is the machine it is already on. In-browser editing is not a stronger promise about how carefully a company handles your files — it is the removal of the need to make that promise at all. Combined with basic hygiene about where you store and how you send the result, it is the reasonable default for anything you would not want read by a stranger.
For more on the surrounding practices, see are online PDF editors safe? and how to share a PDF securely.
