LEGAL

Security

Last reviewed: August 2026

Foliovex's whole design starts from one decision: your files are processed on your own device, not uploaded anywhere. Everything below follows from that, and is a factual description of what's actually implemented — not marketing language.

Files are processed locally

Every tool runs as JavaScript in your browser. A file you select is read and processed on your own device using your own device's memory and processing power. It is never transmitted to, or stored on, any server we operate — we have no technical ability to see the contents of a file you process here, because it never reaches us.

No account, no server-side storage

There's nothing to sign up for and nothing stored server-side tied to you. Settings like your last-used watermark text or dark mode preference are kept in your own browser's local storage, on your device, not on a server.

Passwords are handled locally

The Password Protect tool encrypts and decrypts files using your browser's own processing — the password you enter is used locally and is never transmitted anywhere, logged, or stored. It exists only in your browser's memory for the duration of that operation.

HTTPS and transport security

This site is served exclusively over HTTPS, with HTTP Strict Transport Security (HSTS) enabled to instruct browsers to always use an encrypted connection to this domain.

Security headers

The following are actively set on every page:

Content-Security-Policy — restricts which domains scripts, styles, and connections can load from, to a specific, deliberately short allowlist rather than a broad wildcard.
X-Frame-Options: DENY and frame-ancestors 'none' — this site cannot be embedded in an iframe on another site, which prevents clickjacking-style attacks.
X-Content-Type-Options: nosniff — prevents browsers from trying to guess a file's type in a way that could be exploited.
Referrer-Policy: strict-origin-when-cross-origin — limits what's shared with other sites when you navigate away from a link here.
Permissions-Policy — explicitly disables browser features this site has no use for (camera, microphone, geolocation, payment APIs), reducing what could be exploited even in the event of an unrelated bug.

Third-party dependencies

The PDF processing itself relies on a small number of well-established open-source libraries (pdf-lib, pdf.js, JSZip), loaded from cdnjs, a widely used CDN. The password protection tool additionally loads an encryption library from jsDelivr, pinned to a specific major version rather than an unpinned "latest," so an unexpected future change to that package can't silently affect this site. We deliberately do not use Subresource Integrity (SRI) hashes for these scripts at this time — we looked into it and found cdnjs has a documented history of occasionally publishing incorrect SRI hashes, and a wrong hash doesn't weaken security, it makes the browser refuse to load the library entirely. We'd rather be transparent about that tradeoff than add a security control we couldn't fully verify.

Handling of uploaded files

Even though files never leave your device, the tools still validate that a selected file is genuinely a PDF (checking its actual file signature, not just its name) before processing it, and are built to fail safely rather than crash on a malformed or corrupted file.

What happens to a file in memory after processing

Being honest about this rather than glossing over it: while you're on a tool's page, the file you're working with is held in your browser's own memory for that page, the same as any other data a web page works with. It isn't explicitly wiped the instant a download finishes — it's released the normal way any web page's memory is, by your browser's own garbage collection, when you navigate away from the page or close the tab. It was never written to disk or any persistent storage by Foliovex, and it was never accessible to us in the first place, since it never left your device — but "in memory during this tab" isn't the same claim as "wiped instantly," and we'd rather be precise about which one is actually true.

Reporting a security issue

If you believe you've found a security vulnerability in Foliovex, please report it to foliovex@proton.me. Include as much detail as you can (steps to reproduce, affected tool, browser/OS) so it can be investigated properly. We ask that you give us a reasonable opportunity to address an issue before disclosing it publicly.

See the Privacy Policy for how any optional analytics or advertising on this site is handled.