Security
What happens to your PDF
PDFMK combines local browser previews with temporary server processing. This page describes that flow without hiding it behind vague privacy claims.
Last updated: August 18, 2026
The short version
- You select a document in your browser.
- The document and image tools generate visual previews locally, without uploading the selected files.
- When you start a server operation, the browser sends the document over HTTPS to the PDFMK API.
- The API uses a short-lived temporary working directory to process the request and prepare the result.
- The result is returned to your browser, and temporary working files are removed after the response finishes or the request fails.
Uploaded document content is not used to create advertising profiles, train models, or build a permanent document library. PDFMK does not currently provide user accounts or cloud document storage.
Processing by tool
| Tool | Processing behavior | Result |
|---|---|---|
| Merge | First-page previews and page counts are generated locally. After you click Merge PDFs, inputs are written to temporary PDF files and removed in cleanup. | One PDF |
| Split | Page previews are rendered locally in your browser. After you click Split PDF, a temporary input and output are used for extraction. | PDF or ZIP |
| Organize | Page previews and edit instructions stay local until export. The API then uses a temporary input and output to reorder, rotate, omit, or duplicate pages. | One PDF |
| Watermark | The visual preview is rendered locally. After you click Add Watermark, a temporary input and output are used while text is drawn on the requested pages. | One PDF |
| PDF to Word | The first-page preview and text-layer check stay local. After you click Convert to Word, the selected PDF pages are processed in a temporary working directory and removed after the response. | One DOCX |
| PDF to images | A temporary working directory holds source PDFs and rendered PNG files while the download archive is prepared. | ZIP of PNG files |
| Images to PDF | Image previews and ordering stay local until export. Temporary JPG, PNG, or WebP inputs are then placed onto PDF pages and removed after the response. | One PDF |
What you should not upload
No online processor can promise zero risk. Do not upload a document when law, contract, company policy, or professional duty requires it to stay on a managed device or an approved internal system. That can include medical records, identity documents, privileged legal material, export-controlled data, and unredacted financial records. Use an approved offline tool for those files.
Operational safeguards and limits
- HTTPS protects documents while they travel between a supported browser and the service.
- Temporary-path cleanup runs after successful and failed processing paths.
- ZIP inputs are inspected before extraction and non-PDF entries are ignored by the image converter.
- Password-protected or damaged PDFs may be rejected rather than partially processed.
- Practical size limits depend on page count, image complexity, selected DPI, and available server resources.
Read the Privacy Policy for information about technical logs, advertising, and data rights. Report a suspected vulnerability through the contact page.