Security

This page describes how USA Sky PDF protects your files, your payment information, and your account. We do not exaggerate the strength of these protections — you should understand both what we do and what we cannot guarantee.

Transport security

All traffic between your browser and our servers uses HTTPS with TLS 1.2 or 1.3. HSTS (HTTP Strict Transport Security) is enabled with a one-year max-age and preload, so modern browsers refuse to connect over plain HTTP even if a network attempts to downgrade the connection.

In-browser-first design

Most of our 41 tools run inside your browser. Your file never leaves your device — it is parsed, edited, and exported locally in your browser without any upload. The benefit is plain: data we never receive is data we cannot expose.

Server-side processing (OCR, conversions, compress)

A small number of tools require server-side processing because their workloads do not fit in a browser environment:

• OCR — processed on our servers, not in your browser.
• PDF ↔ Word / Excel / PowerPoint and HTML → PDF conversions — processed on our servers.
• Compress — processed on our servers.

For these tools your file is uploaded over an encrypted connection to a presigned AWS S3 URL, processed in a private Lambda invocation, and the resulting output is downloaded back to your browser. The S3 prefix that holds both the input and the output is governed by a 24-hour expiry rule that AWS applies automatically and that we cannot bypass. After 24 hours, the file is gone from our infrastructure.

What we do not do with your files

• We do not store your files long-term. Server-side files live for at most 24 hours.
• We do not train any AI or machine-learning model on your files.
• We do not read the contents of your files. Our staff have no business reason to open them, and our infrastructure access is logged.
• We do not share files with third parties beyond the AWS sub-processors strictly required to run the conversion (see the sub-processor table in our Privacy Policy).

Payment security

Subscriptions and one-time purchases are processed by Stripe. Card details are entered directly into a Stripe-hosted form rendered inside an iframe; the data never touches our servers. We are not in scope for PCI DSS as a card-data handler because we never receive or store full card numbers. We receive a Stripe customer ID, a subscription status, and (for the receipt) the last four digits of the card.

Account access

Accounts are protected by passwordless email magic links and by Stripe Customer Portal sessions for billing. We do not store passwords because we do not have a password-based login flow. If you suspect unauthorised access to your account, email support@usapdfsky.com and we will invalidate active sessions.

Internal access

Our team accesses production infrastructure on a least-privilege basis. Console access requires multi-factor authentication. Credentials are rotated regularly. Access events to S3 and Lambda are logged in CloudWatch and retained for security review.

The honest disclaimer

Responsible disclosure

If you find a security issue in USA Sky PDF, please report it to support@usapdfsky.com with the subject line “Security report”. We acknowledge reports within 5 business days and aim to fix verified issues within 30 days, depending on severity. We do not currently operate a paid bug-bounty programme, but we publicly credit researchers who report responsibly (with their permission).

Please do not publicly disclose an issue until we have had a reasonable opportunity to remediate it. Please do not run automated vulnerability scanners that generate destructive traffic against our production infrastructure.

Related

For data-collection details see the Privacy Policy; for cookie/storage details see the Cookies Policy.