English ▾
Free, Fast & Secure Online Tools
The situation is ordinary enough. A client sends back a signed agreement as one scan and three exhibits as separate files, and you need them merged into a single document before it goes out. You search for “merge PDF”, click the first result, drag the files in, and it is done in ten seconds.
The moment you let go of the mouse, that contract was on somebody else’s server.
Most of these sites process files server-side. Your document is transmitted over the network, written to storage, read by a program on their machine, turned into an output file, and sent back. Along the way it usually passes through third-party cloud infrastructure, because compute, storage and CDN are rarely the same company.
None of that implies bad faith. Most of these services have clear privacy policies and most of them mean what they say: deleted after an hour, never used for anything else, never looked at by a human. The problem is not whether they are honest. The problem is that you cannot verify it. From the outside, “deleted” and “still there” look exactly the same.
When a private individual uploads a holiday photo to be compressed, the risk is their own. When the file contains a client’s information, you are no longer dealing with a risk but with an obligation — and the obligation sits with you, not with the website.
Some concrete examples:
This is general information rather than legal advice, and your own jurisdiction and professional body are what actually govern you. But one thing holds everywhere: once the file has left, you cannot call it back.
That may be entirely true, and it still does not solve three things.
First, it is a promise, not an auditable fact. Second, even if they do delete it, the data existed before deletion and may have reached a backup, a log, or a cache on the way. Third, if that company is breached, what leaks is your client’s contract, and the person who has to explain it to the client is you.
A useful test: if you would not put the document on a postcard, do not hand it to a third party you have no way to audit — however good their policy looks.
Modern browsers can do this work locally. WebAssembly lets the same PDF and image libraries that used to require a server run inside the browser instead. JavaScript reads the file from your disk into memory, processes it on your own machine, and writes the result back to your disk.
It never leaves the device, so the question of how long anything is retained does not arise — there is nothing to retain.
Do not take anyone’s word for this, including ours. Your browser will tell you directly.
One thing to be clear about, so you do not misread the result: you will still see plenty of network requests even when nothing is uploaded — fonts, stylesheets, ads, analytics. That is the web page, not your document. What distinguishes them is the payload size, and whether the request fires at the moment you click “process”.
That test applies to us too, incidentally. The PDF merge tool on this site runs in the browser, and you can verify it with the second method right now — load the page, disconnect, merge, download. It will finish.
Not every file deserves this much care. Public data, your own photographs, documents that have already been published — upload those anywhere you like. Server-side processing is often faster and has more features.
The ones worth stopping over are narrower: client or patient records, unsigned agreements, payroll and personnel files, identity documents, financial statements, anything marked confidential.
The deciding question is a short one: if this file leaked, would somebody have to be notified? Then don’t upload it.
Do it in your browser — the file never leaves your device: PDF Tools