PDFArrow · Trust center
How PDFArrow processes documents, identity, storage, and analytics
Four separate paths explain most of the product: static app delivery, local document processing, optional signed-in storage, and privacy-safe operational events.
Reviewed July 21, 2026 by PDFArrow Product Engineering.
1. Application delivery
The public React application and static assets are delivered to the browser. Editor and conversion code is loaded only when a route needs it so the marketing and resource pages do not preload the PDF engine.
2. Local document processing
Supported tools read the chosen file into browser memory, perform the operation on-device, and create a local download. Closing the tab releases memory; browser-saved work follows local storage rules.
3. Optional identity and cloud history
Firebase Authentication handles sign-in. Signed-in document history can use Firestore for records and Firebase Storage for payloads when configured. Guest use does not depend on this path.
4. Operational analytics and support
Bounded events record route, tool, broad file characteristics, outcome, duration, and broad client class without document content. Support messages are separate records readable only by the site owner.
Trust boundaries
Your device and browser remain part of the security model. External services have their own operational boundaries. PDFArrow has not completed a SOC 2 audit, ISO certification, penetration-test publication, or enterprise SLA.