Security & retention
What we keep, and for how long.
This page describes how the LigriPDF server actually handles files and data. Where the behaviour depends on a setting, it says so instead of assuming the safest value.
Two things are deliberately absent from this page: a promise that files are processed only on your own machine, and a promise that stored copies are encrypted by the application. Files are processed on the server, and stored copies are protected by filesystem permissions, as set out below.
In transit
Every request arrives over HTTPS. Caddy terminates TLS at the edge with a Let's Encrypt certificate that renews automatically. The Python application listens only on the loopback address (127.0.0.1:8080) and is reached through Caddy, not directly from the internet.
The free batch tools
Each batch request creates a fresh temporary directory. Your uploaded file is written there, processed, and the directory is deleted after the response is sent. The same cleanup runs when processing fails, so a failed job does not leave the upload behind. No copy is kept for later.
Documents in the editor
Editor documents are held in server memory and dropped after 60 minutes without activity. By default they are not written to disk at all.
Session persistence is opt-in. When the operator enables
PDF_PERSIST_SESSIONS, open documents and their undo history are
written to a private directory so a restart does not lose work. Those files are
plain, unencrypted PDFs: the protection is filesystem permissions (directory
0700, files 0600), not application encryption. They are deleted when the
document is closed, evicted, or expires, and the editor shows a warning while
the option is on.
Encryption at rest
LigriPDF does not encrypt stored files itself. Copies that are written to disk are plain PDFs with owner-only permissions. Encrypting the server's disk is a host-level setting the operator can turn on; this page does not claim that it is enabled.
Copies that are kept on purpose
A few features need a document copy to outlive the request. They are listed here rather than left out of the retention story, together with what ends their access.
- Share links. A share keeps its own copy of the PDF. Links default to seven days, can be set from zero (no expiry) to 365 days, and can be revoked. When the link expires or is revoked, the stored copy is deleted within a few minutes.
- Signature requests. A request keeps a PDF snapshot, and a completed signature keeps the signed result. Requests expire after a period you choose, seven days by default and at most 30. The unsigned snapshot is deleted when the request is signed, cancelled or expires; only the signed result is kept afterwards.
- Font library. The library is on by default. When a PDF is
opened in the editor, font faces embedded in it are extracted into a library
shared by the editor so they can be reused in other documents. It can be turned
off with
PDF_FONT_LIBRARY=0.
Accounts, credits and logs
An account stores the username, email address, a salted password hash, the role, the creation date, and the two-step verification secret if it is enabled. The password itself is never stored. Credit movements are recorded in an append-only ledger; it holds no card data.
The audit log is one JSON object per line with a timestamp, user, action, detail, status, duration, client IP and byte count. Document contents, document text, chat messages and passwords are never written to it; the only file name it records is that of an attachment added to an editor document. The file is created with owner-only permissions (0600).
Third parties and analytics
The site loads no analytics scripts, advertising pixels or conversion services. HTML layout, OCR and Office conversion run as local processes on the server. Server access logs record the request path, status, time and client IP; they do not contain document contents.
The AI features are the exception, and only when configured: chat-to-edit,
AI rewrite or translate, and metadata generation send the relevant document
text and your instruction to the configured DeepSeek-compatible API. Those
features are unavailable when DEEPSEEK_API_KEY is not set.
Where the server is
LigriPDF runs on a virtual private server (VPS) operated by the operator of this site, with Caddy in front of the application on the same machine. Files are processed on that server.
Contact
Security questions and reports: use the contact page. A public address is published there once the operator has one; none is invented on this page.