Your documents are safe with us

Privacy isn't a feature at 400Tools — it's the architecture. Whenever possible, your files never leave your device. When they must be processed, they're encrypted, ephemeral, and never used for anything else.

🔒

HTTPS / TLS

🛡️

GDPR Ready

📄

Client-Side First

How we protect your files

💻

In-browser processing

Most tools run entirely on your device using JavaScript engines like pdf-lib and pdf.js. Your file is opened, edited, and saved without ever being uploaded to a server.

🔐

Encrypted in transit

Every connection to 400Tools uses HTTPS/TLS encryption. For the few operations that need a server, your file travels encrypted from your browser to the processing worker and back.

🗑️

Automatic deletion

Server-processed files are held only for the seconds needed to do the work, then permanently deleted. We keep no archives, backups, or review copies of your documents.

🤖

No AI training

Your documents are never used to train AI or machine-learning models. AI-powered tools process your content on demand and discard it immediately.

💳

Secure payments

Billing is handled entirely by Paddle, a PCI DSS Level 1 certified merchant. Card details never touch our servers — we only ever see a payment status.

🛡️

Protected accounts

Accounts are managed by Supabase with secure authentication, hashed credentials, and row-level security so your profile and billing data stay isolated.

The life of your file, step by step

Full transparency about what happens from the moment you pick a file to the moment you download the result.

1. You select a file+

Your file is read by the browser itself using a standard file input. Nothing is sent anywhere at this stage — you can even disconnect from the internet after loading the page and most tools will still work.

2. Processing happens on your device (when possible)+

Merge, Split, Organize, Rotate, Extract, Remove pages, Page numbers, Watermark, Crop, Sign, Edit, Protect, Unlock, Redact, JPG↔PDF, PDF to JPG, PDF to Markdown and more are computed entirely in your browser. Your document never crosses the network.

3. Server processing only when required+

A small number of operations (e.g. advanced OCR language packs, certain conversions) need server-side compute. In those cases the file is uploaded over HTTPS, processed in an isolated worker, and the result is streamed back to you.

4. Everything is deleted+

Once you receive your result, server-side copies of the input and output are immediately and permanently deleted. There is no retention window, no backups, and no way for anyone — including us — to retrieve your document later.

5. You own the result+

Your output files are yours alone. We claim no rights over your documents or their contents, and we never inspect, share, or monetize them in any way.

Infrastructure & compliance

🌐

HTTPS everywhere

Every page, script, and API call is served over TLS. Mixed content is blocked, and security headers protect against common web attacks.

🗄️

Supabase

Accounts and profiles live in Supabase (PostgreSQL) with row-level security policies, so one user's data is inaccessible to every other user.

🧾

Paddle billing

Subscriptions and payments run through Paddle's merchant-of-record infrastructure — PCI DSS Level 1, SCA-ready, with global tax handling.

📋

Standards-aware PDF handling

Our tools work on the PDF document structure itself, so standards-based PDFs round-trip through editing operations without corruption.

🔍

Open about limits

We won't pretend client-side tools do everything. When a task truly needs a server, we say so on the tool page — no silent uploads behind your back.

⚙️

Continuous updates

Libraries like pdf-lib and pdf.js are kept current, and security fixes ship continuously. Reported issues are verified and patched with priority.

Security questions, answered

The short version of how we handle data. More general questions live in the full FAQ.

Can 400Tools staff read my documents?+

No. Browser-processed files never reach our infrastructure at all, and server-processed files are deleted immediately after use. There is no admin tool or backdoor to view user documents.

Do you log file contents or names?+

No. We do not log document contents. Operational logs contain only anonymous technical events (e.g. "tool X ran successfully") needed to keep the service reliable.

Is my payment information safe?+

Yes — and it never reaches us. Card numbers are entered on Paddle's secure, PCI DSS Level 1 certified checkout. Our servers only receive confirmation that a subscription is active.

What about encrypted or password-protected PDFs?+

Unlock and Protect tools operate on your device. If you don't know a document's open-password, no one can decrypt it — not us, not anyone. We never attempt to crack passwords.

Do you sell or share data with third parties?+

Never. We do not sell, rent, or share user documents or personal data with advertisers or data brokers. The only third parties involved are core infrastructure providers (Supabase for accounts, Paddle for billing) under strict data-processing terms.

Report a vulnerability

Security researchers are welcome. If you discover a vulnerability in 400Tools, please report it responsibly — include steps to reproduce, affected tool, and impact. We verify every report, patch with priority, and credit researchers who help us improve.

Contact security team

Popular

All Tools