01Where your files are processed

Every PDF tool, the Translate tab and the Gap Assessment run as JavaScript and WebAssembly inside your browser tab. Your files are read from your device into the tab’s memory, processed there, and offered back to you as a download. They are never uploaded to paperwingpdf.com or to anyone else.

Files are cleared from memory when you start over, switch tools, or close or reload the page.

02What does go over the network

Only these requests leave your browser:

• The pages, code libraries, fonts, OCR language data and WebAssembly components, all downloaded from paperwingpdf.com. None of these requests contain your files or text.
• Cloudflare Web Analytics, which counts page views without cookies and never sees your files.
• If you use Translate or the AI Summarizer in Chrome or Edge, your browser may download its own language or AI model from Google or Microsoft. The model download contains no document content.

03How we verify it

An automated test suite runs every tool in a real browser and records every network request made while the tool works. A test fails if any request goes anywhere other than paperwingpdf.com’s own static files.

You can check it yourself: open your browser’s developer tools, choose the Network tab, and run a tool. You will see no upload. You can also load a tool, switch off your internet connection and run it: it still works, except for the first OCR run in a new language, which needs to download that language’s data.

04Browser security controls

Paperwing sends strict security headers and policies:

• Content Security Policy: scripts, styles, fonts and connections are limited to paperwingpdf.com (plus the Cloudflare analytics script). No inline JavaScript runs on any page.
• 'wasm-unsafe-eval' is allowed on the PDF tools page only so the browser can compile the WebAssembly components used for OCR and for PDF encryption. It does not allow JavaScript eval().
• The Gap Assessment page runs without 'unsafe-inline': its buttons are connected through a dispatcher that can only call the app’s own functions with plain values.
• Everything you type into the Gap Assessment is escaped before it is shown, so text such as <script> is displayed, never run. This is tested with injection payloads on every screen, report and export.
• HTTPS only (HSTS), no MIME sniffing, no embedding by other sites (frame-ancestors 'self'), a strict referrer policy, and camera, microphone, location and payment features switched off for the page.

05Third-party code

All libraries are pinned to exact versions and served from paperwingpdf.com, so a compromised CDN cannot change them: PDF.js, pdf-lib, JSZip, SheetJS, Mammoth, jsPDF, Chart.js, Tesseract.js, qpdf (WebAssembly) and PptxGenJS. Their licences are published in /vendor/licenses.

06Data stored in your browser

The PDF tools store only your language and theme choice.

The Gap Assessment stores your assessments, audits, supplier records and ESG data in this browser’s local storage so you can continue later. Local storage is not encrypted: anyone who can use this browser profile, and any browser extension with access to the site, can read it. Use a personal device for sensitive assessments.

The optional local profile puts your name on reports. It is not an online account and its password does not encrypt anything; only a salted PBKDF2-SHA-256 hash of the password is kept.

Encrypted backups use AES-256-GCM with a key derived from your passphrase by PBKDF2-SHA-256 with 600,000 iterations. Paperwing never sees the passphrase and cannot recover a backup without it. Restored files are checked and only known data types are accepted.

“Erase all Gap Assessment data” in the Backup window deletes everything the Gap Assessment stored in this browser.

07Redaction

Redact PDF rebuilds the document. Every page that has a redaction is converted into an image at 200 dpi with the marked areas filled in black, so the hidden text, its fonts and any annotations on that page are gone from the file. Pages without redactions are copied unchanged.

Bookmarks, attachments, form fields, JavaScript and the original metadata are not carried over, and document properties are removed unless you choose to keep them.

Search marks text in the PDF’s text layer. Text that is part of an image (for example a scan) cannot be found by search: mark it by hand, and always check the result before sharing it.

08Passwords and encryption

Protect PDF encrypts files with AES-256 (PDF security handler revision 6) using qpdf compiled to WebAssembly. Unlock PDF removes protection only when you supply the password, or when the file has only permission restrictions. Passwords are used in memory and never stored or sent anywhere.

09Known limitations

Your browser, operating system and installed extensions can see what you open in any web page, including Paperwing.

On a shared computer, other users of the same browser profile can see stored Gap Assessment data. Erase it or use a private profile.

Cloudflare, which hosts the site, keeps standard request logs (IP address, time, page requested) to deliver and protect the service. These logs never include your files.

10Reporting a vulnerability

If you find a security issue, please email contact@paperwingpdf.com. Our machine-readable contact details are published at /.well-known/security.txt. Please give us a reasonable time to fix the problem before you disclose it.