When you drag a PDF onto a free online editor, your document is transmitted over the internet to a third-party server. This is not a criticism of any particular service — it is simply how server-side processing works. The file has to arrive somewhere before anything can be done to it.
For a takeaway menu, this is fine. For a corporate contract, a medical history, an invoice with bank details, or a tax return, it deserves more thought than it usually gets.
The retention window
Most free platforms hold uploaded files for somewhere between one and twenty-four hours. Some hold them longer to support a "recent files" feature that users find convenient.
During that window your document exists on infrastructure you have not assessed, under a policy you have not read, accessible to employees you have never met, and subject to whatever legal process applies in that jurisdiction. None of that requires anyone to behave badly for it to be a real exposure.
Who can see it
In practice, several categories of people and systems can access a file during its retention window: the platform's operations staff, any automated scanning or indexing the platform runs, whoever holds their cloud storage credentials, and anyone who obtains those credentials illegitimately.
Every major cloud document vendor has disclosed at least one security incident in the past five years. That is not remarkable — it is what happens to every company that holds data at scale. The lesson is not that these companies are careless; it is that files held anywhere are eventually at risk, and the only file with no breach risk is the one that was never transmitted.
The compliance angle
If you work somewhere with a data loss prevention policy, uploading a client document to a free converter may itself be a policy violation, entirely separate from whether anything happens to the file. Managed devices frequently log outbound transfers, and "I needed to merge two PDFs" is a thin explanation in an audit.
Under GDPR, sending personal data to a third-party processor without a lawful basis and a processing agreement is a problem in its own right. HIPAA has an equivalent structure for protected health information. In both cases, the upload is the event that creates the obligation.
Client-side processing removes the question
The alternative is to do the work where the file already is. Modern browsers can run WebAssembly at close to native speed, which means merging, splitting, compressing, signing, OCR and format conversion can all happen locally.
PDF Vault is built entirely this way. Your file is read into memory, processed on your own processor, and written back to your disk. There is no upload endpoint, so there is no retention window, no third-party access, and no processing agreement required — because no third party ever processes anything.
You do not have to believe us about this. Open developer tools, watch the Network tab, and run any operation on the site. The absence of a request carrying your document is the proof.
A reasonable policy
You do not need to be absolutist. A sensible rule: if you would not paste the document into a public group chat, do not upload it to a free converter. For everything above that line, use a tool that processes locally.
It costs you nothing and removes the question entirely.