Every tool runs inside your browser tab. Your documents, their text, their file names and the passwords you set are never sent to StayPutPDF or anyone else. Below are two simple ways to check that yourself.
Test 1: Airplane mode · anyone, 1 minute
Open StayPutPDF and open the tool you want to use once, so your browser loads it.
Turn off Wi-Fi (or switch on airplane mode, or unplug the cable).
Drop in a PDF, run the tool and save the result. It works with no internet at all — because the work is done by your own device, not by a server.
A few features download an extra component the first time you use them — OCR language packs, Excel support and fonts for some languages. That is a download to you; your file is still not sent. Use them once while online and they work offline too.
Test 2: The Network tab · for IT, 3 minutes
Open your browser's developer tools (F12, or right-click → Inspect; in Safari, enable the Develop menu first) and go to the Network tab.
Use any tool — redact, merge, OCR — and keep watching the Network tab.
Look at every request. You will see some — the list below says what each one is. None of them carries your file, its text or its name. Tip: sort by size — the large requests are libraries downloaded to you, never uploads.
What does go over the network
We'd rather tell you than have you find it. These are all the outside requests the site makes:
- stayputpdf.com — the site's own pages and code, downloaded to you.
- cdn.jsdelivr.net, cdn.sheetjs.com, tessdata.projectnaptha.com, fonts.googleapis.com, fonts.gstatic.com — open-source libraries, OCR language packs and fonts, downloaded to you when a tool needs them.
- eu-assets.i.posthog.com, eu.i.posthog.com — the analytics script and anonymous usage counts, such as "merge done, 3 pages". No file names, no content, no click tracking and no session recording.
- assets.lemonsqueezy.com, api.lemonsqueezy.com — Lemon Squeezy, our payment provider. Its checkout script loads with the page; your email and license key are sent only when you buy Premium or enter a key.
- api.web3forms.com — only when you send us a message through the contact form.
What never goes over the network:
- Your PDF or any other file you open
- Any text from your documents, including text found by OCR
- File names
- Passwords you set with Protect PDF
Details on what we keep about buyers are in the Privacy Policy. The open-source libraries are listed on the Licenses page.
For compliance teams: HIPAA and GDPR
Patient and client files never reach us — there is nothing for us to store, leak or hand over.
- Because document contents never reach StayPutPDF, we do not receive, store or process the personal data or health information inside your files.
- For the same reason we don't sign Business Associate Agreements or data processing agreements for document contents.
- We do not hold SOC 2 or ISO 27001 certifications and we don't issue compliance certificates. What we offer instead is an architecture you can check yourself, with the two tests above.
- Whether a tool fits your policies is your organisation's decision. Feel free to share this page with your compliance or IT team.
What this does — and doesn't — cover
Your files are never sent to us, so there is nothing on our side to be breached, subpoenaed or misused.
Your own device's security, browser extensions with broad permissions, and checking the result. We don't provide forensic validation, cryptographic verification or compliance logs for individual files. The final check is yours.
Want the technical detail? Read how StayPutPDF processes files without a server.