Paperly
Upload PDF

Security & privacy

Last updated: August 2026

Paperly’s security model is simple: your files never leave your device. This page describes the verified practices behind that statement.

Client-side processing

All PDF engines run in your browser using JavaScript. Files are read into memory in the current tab, processed there, and the result is downloaded to your device. There is no upload endpoint and no server-side document processing.

We do not claim “100% secure” or “impossible to hack” — no service can. What we can verify is that your document bytes are never transmitted to or stored by us.

Transport and hosting

  • The site is served over HTTPS when deployed, protecting the (already minimal) traffic between your browser and the site.
  • The site ships with a Content-Security-Policy and nosniff/X-Frame-Options headers to reduce common web attacks.
  • Dependencies are kept up to date, and the open-source PDF libraries we use are widely audited.

What we never do

  • We never upload, store or analyze your documents.
  • We never require an account or collect an email address to process files.
  • Anonymous analytics events (if enabled) never include file contents, file names or document data.

Reporting a security issue

Found a vulnerability? Please report it privately to support@paperly.app with the subject “Security”. Describe the issue without including sensitive data, and we will respond.

Your part in staying secure

  • Keep your browser updated — PDF processing relies on current browser security fixes.
  • Process documents on a device and network you trust, since the work happens locally.
  • Review redacted output before sharing it, and verify that nothing sensitive remains visible.

FAQ

No. Processing happens entirely in your browser. Your files are never transmitted to or stored on any server.