In an era of frequent data breaches, ransomware, and strict GDPR regulations, uploading sensitive legal, medical, or financial documents to a cloud tool requires absolute trust. How do you know your data is safe? In this transparency report, we break down the security architecture of PDFCompress.shop.

The Risks of "Free" Tools

The internet is flooded with free tools. However, hosting a server costs money. If a tool is free and has no ads or premium plans, you are likely the product. Some unscrupulous sites harvest email addresses from resumes or analyze document metadata for marketing analytics.

PDFCompress.shop is different. We monetize via transparent, privacy-friendly display advertising, which allows us to offer a truly free service without needing to harvest or sell user data.

Layer 1: Encryption in Transit (TLS 1.3)

Security begins the moment you drag a file into your browser. We utilize TLS 1.3 (Transport Layer Security), the modern standard for web encryption. This ensures that the tunnel between your device and our server is unbreakable. Even if you are using our tool on a public coffee shop WiFi, an attacker intercepting the data would only see scrambled, illegible hash codes.

Layer 2: Server-Side Sandboxing

When your file reaches our infrastructure, it does not go into a public shared folder. Each upload session is assigned a unique, cryptographically generated Hash ID (e.g., f4a9c2...). The file is stored in a temporary "sandbox" environment that is isolated from the operating system and other users.

Layer 3: The "Zero-Knowledge" Retention Policy

This is the most critical aspect of our security posture. We operate on a strict Automated Deletion Policy.

  • No Backups: We do not back up the "uploads" directory to secondary storage.
  • Automated Cron Jobs: A server-side script runs every 60 minutes. This script force-deletes every file in the upload and processing directories that is older than 1 hour.
  • No Human Access: Our system is automated. No admin or support staff has keys to view the contents of user uploaded files.

GDPR, CCPA, and Data Sovereignty

For our users in the European Union (GDPR) and California (CCPA), data sovereignty is a legal requirement. Because we delete data almost immediately, we act as a "Data Conduit" rather than a "Data Warehouse." We do not store "Personally Identifiable Information" (PII) extracted from your documents. This makes our tool safe for standard business use cases where temporary processing is required.

Client-Side vs. Server-Side: The Trade-off

Some competitors promote "Client-Side" processing (via WebAssembly) as safer because the file never leaves your computer. While true, browser-based compression is weak, slow, and often crashes on large files. Server-side processing provides the computational power needed for high-quality compression while our "Zero-Retention" policy provides the security. It is the best of both worlds.