Updated on
A rental contract, a payslip, a medical report: these are often exactly the documents you need to merge, sign or convert. Many PDF sites ask you to upload them. What actually happens then, and what are the alternatives?
What an upload means
When you upload, your file travels to the website’s server. It is processed there and stored for a while, until you download the result. Many services promise to delete your file after some time. That is a promise you can hardly check yourself.
- Your file sits, if only for a while, on a computer you don’t know.
- You don’t always know which country that server is in, or which other companies (hosting, storage, backups) are involved.
- Servers keep logs. Even when the file itself is deleted, the file name or other details can stay behind for a while.
- If you work with data of clients or patients, you pass it on to a third party. Under the GDPR that usually requires a data processing agreement.
Which documents deserve extra care?
- Contracts and offers with amounts, names and signatures.
- Payslips, tax returns and bank statements.
- Medical reports, prescriptions and insurance documents.
- Copies of an identity card or passport.
- Anything with data of other people: clients, patients, pupils, employees.
Questions to ask before you upload anywhere
- Is it clear who runs the service and in which country the servers are?
- Does the privacy policy say how long files are kept, and whether they are used for anything else?
- Do you need an account, and what happens to the files linked to it?
- Is there a way to do the same job without uploading the file?
The last question is often the simplest one to answer.
The alternative: processing in your browser
A modern browser can merge, compress and convert PDFs itself. Then your file isn't uploaded. So there is nothing to delete on a server. That is how every PDFCommunity tool works. You can read more about the GDPR on our GDPR page.
Your browser can show you which data a website sends. We explain how on Verify it yourself, and in How to tell if a PDF tool uploads your file.
What still matters
Processing in the browser takes the server out of the picture, but your own device and the way you send the file still count:
- Clean up your Downloads folder on a shared computer.
- Protect sensitive PDFs with a password before you email them, with Protect PDF, and send the password through a different channel.
- Remove hidden information such as the author name with Remove metadata.
Frequently asked questions
Is uploading a contract illegal?
Not in itself. For your own documents it is your choice. If you handle data of others for your work, the GDPR does set rules for sharing it with a service. This guide is general information, not legal advice.
How can a website work without uploading my file?
The tool’s code is loaded into your browser, and your browser runs it on the file on your own device. The website only delivers the code; your file is not sent back.
Does this also work for signing a contract?
Yes. With Sign PDF you place your signature in your browser as well, without uploading the contract.