Security built in, not bolted on.

Render isolation

Each PDF render runs in an isolated, sandboxed environment with no credentials attached and no route to private infrastructure. Outbound requests from rendered pages are validated against public IP ranges before being allowed. Requests to private RFC-1918 address space, loopback, and link-local ranges are blocked at the network layer.

Data we store

We store the minimum required to operate the service.

• ·API keys: hashed. The plaintext key is shown once at creation and never stored afterward.
• ·Usage counts: a per-billing-period counter to enforce plan limits.
• ·Stored documents: encrypted at rest, retained for the duration set by your plan, then automatically deleted.
• ·Analytics events: aggregate counts only. No user-level behavioral tracking.

Data we never store

The following is processed in memory and discarded immediately after the render completes.

• ·The HTML source or URL you send us. It is not written to any persistent storage.
• ·Credentials or session tokens from rendered pages.
• ·Webhook payloads sent to your endpoints.
• ·The content of rendered pages beyond the output PDF.

Transport

All API traffic is encrypted in transit. We enforce TLS 1.2 as the minimum version. HSTS is enabled with a one-year max-age including subdomains. Plain-HTTP connections are redirected to HTTPS automatically.

Credentials

API keys are shown once on creation. After that, only the hashed form is stored. If you suspect a key has been exposed, rotate it instantly from your dashboard. Old keys are invalidated immediately on rotation.

Responsible disclosure

If you find a security issue, email security@pdfpipe.xyz with a description and reproduction steps. We respond within 24 hours and will work with you on a coordinated disclosure timeline. We do not pursue legal action against good-faith researchers.