Security overview

Editing, conversion, compression, OCR, organisation, redaction and encryption run inside your browser. Document bytes are not transmitted to a server for these tools, which removes the largest category of document exposure entirely.

The optional signature-request feature is the single exception: the document is stored encrypted, reachable only through an unguessable single-purpose link, and deleted when the request expires.

Traffic is served over HTTPS with modern TLS. Stored signature documents are encrypted at rest, database access is protected by row-level security policies, and privileged credentials are held server-side only and never exposed to the browser.

System clocks are synchronised to NTP sources traceable to NPL/NIC as required by the CERT-In Directions, and dependency scans are run so known-vulnerable libraries are updated.

The password tool applies AES encryption with the permissions you select. Passwords are used only for the operation in your current session and are never stored or transmitted.

Whiteout and redaction permanently remove the covered content from the page's content stream rather than drawing a box over it, so redacted text cannot be recovered by copy-paste or text extraction. Always reopen and verify the output before distributing a sensitive document.

No tool can recover a password you forget for an encrypted output file.

Reportable cyber incidents under Annexure I of the CERT-In Directions — including unauthorised access, data breach, data leak, website intrusion, malicious code and denial of service — are reported to CERT-In within six hours of noticing or being notified of the incident.

ICT system logs are maintained securely for a rolling period of one hundred and eighty days and, where required, within Indian jurisdiction, and can be produced to CERT-In on lawful direction.

A personal data breach is intimated to affected data principals and to the Data Protection Board of India in the manner and timelines set out in the DPDP Rules, with a description of the breach, its likely consequences and the mitigation taken.

We are responsible for the application, its dependencies, its hosting configuration and incident handling. You remain responsible for choosing appropriate documents, strong passwords, correct recipients, secure devices and your own retention practices.

Use a current browser, avoid untrusted shared devices for confidential documents, download and verify output files, distribute passwords through a separate secure channel, and delete local copies you no longer need. For regulated or confidential records, follow your organisation's policy before processing or sharing.

If you believe you have found a security issue, report it from the contact page with reproduction steps, the affected route, the browser used and any proof-of-concept detail. Please do not include sensitive document contents in the report.

We acknowledge reports promptly, keep the reporter informed, and do not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption. Please give us a reasonable window to remediate before public disclosure.