Is Smallpdf safe for sensitive documents?

Everything below comes from Smallpdf’s own published pages, as of October 2026. Follow the links to check the current wording before you decide.

Is Smallpdf secure?

Smallpdf AG is incorporated in Switzerland, with its office in Zürich, according to its privacy notice (last updated 29 July 2025). It publishes a fair amount about security:

• Certification. Its security page says Smallpdf is ISO/IEC 27001 certified and undergoes annual audits, and that it complies with the GDPR, the California CCPA and Switzerland’s data protection law (nFADP).
• Encryption. The privacy notice says all communication and file transfers to and from its servers are encrypted with TLS, and passwords are stored only as hashes.
• Where files are processed. The privacy notice names Hetzner, a German hosting company, as the provider that processes uploaded files, on servers in the European Union, without permanent storage.
• AI features. For Chat with PDF, the summariser and translation, the privacy notice says Smallpdf does not use your files to train models and doesn’t store them unless you save the results.
• Payments. Card numbers go straight to the payment provider; the privacy notice says Smallpdf sees only the first and last four digits.

We did not find any reliable report of a Smallpdf data breach.

How long Smallpdf keeps your files

Smallpdf’s Compress PDF page says it automatically deletes files after one hour. The privacy notice gives more detail, and it depends on how you use the service:

• Logged in: files are deleted within one hour unless you save them to your Smallpdf storage. If you later delete a saved file, Smallpdf says it generally removes it within 14 days.
• Not logged in: the privacy notice says Smallpdf will “generally aim to delete User Files within a reasonable period of time after the last time they were opened”, and that this period is extended each time a file is reopened.
• Shared links: the privacy notice says that by default, documents you process “are accessible to anyone with a unique sharable URL”, and that you can disable this. If you handle confidential files, it is worth turning off.

Is Smallpdf safe for sensitive documents?

Smallpdf’s protections are real, but they all apply after the upload. Your file still travels to its servers, is processed there and waits to be deleted. Encryption in transit protects it on the way; once it arrives, the company’s systems can read it. You can’t confirm from your side that a deletion happened on time.

Think about that before uploading:

• Aadhaar, PAN, passport or driving licence scans
• bank statements and cheques for a home loan or KYC
• Form 16, ITR acknowledgements and salary slips
• contracts, rent agreements and medical reports

The website also uses advertising and analytics tools. The privacy notice lists Google Analytics, Google Ads remarketing, the Meta (Facebook) Pixel and the LinkedIn Insight Tag, and says these run if you accept them in the cookie banner. They track your visit; they aren’t described as receiving your files.

Smallpdf also offers a Windows desktop app that it describes as offline PDF tools. If you already use Smallpdf, that is the better route for confidential files, because work done offline doesn’t need an upload.

Smallpdf compared with an in-browser tool

InTheTab handles the files it supports inside your browser tab. The PDF engine runs on your own device, so there is no server copy to keep or delete.

InTheTab is smaller and has limits of its own. It has no PDF to Word conversion and no OCR for PDFs. Very large files depend on your device’s memory and speed, so an old phone may struggle with a long scanned document. Google Analytics counts visits and which tool was used, but it never receives your files or what you type into a tool; the privacy policy has the full list.

Check it yourself

Any site can say your file stays private. You can see what actually happens in your browser’s developer tools: open the Network tab, run a tool on a test file, and look for a request that carries the file. Our guide on checking whether a site uploads your files shows how in Chrome, Edge, Firefox and Safari.

You can also compress a PDF to fit a portal’s size limit, redact account numbers you don’t need to share, or add a password before emailing a document.