Security at Pandus

Practical safeguards, with their limits explained.

Connections and access

The public site uses HTTPS through Cloudflare. The origin server is configured for HTTPS too. A temporary, random session cookie controls access to your workspace. File requests must belong to that session; knowing a file URL alone is not enough. Keep your browser session private.

Server-side processing

Documents are processed on the origin server, in a separate worker container with restricted networking, an unprivileged user, a read-only system filesystem and bounded memory, CPU, process count and processing time. This worker is shared between jobs; it is not a separate machine for every user. These measures reduce risk but cannot eliminate it.

Temporary storage

Uploaded files and results are stored in a dedicated server volume. Access expires one hour after the workspace is created. Cleanup checks run every 30 seconds, skip workspaces still processing and retry after deletion failures. Processing, outages or storage errors can delay physical removal. Closing the tab does not immediately delete files.

Use “Delete files now” to request deletion of the whole workspace when processing is finished. Removing a page or file from the editor only changes your selection. It does not immediately delete the server copy.

Errors and document integrity

A failed merge does not replace the previous successful result. Failed uploads and incomplete outputs are scheduled for immediate removal by the application, with workspace cleanup as a fallback. Supported pages keep their text, images and vector content rather than being turned into screenshots.

Ordinary interactive forms, bookmarks and attachments are currently rejected. Signed PDFs require explicit consent to create an unsigned copy. The original upload remains unchanged. Signature validity is not checked, and an original signature does not certify the new document.

Infrastructure and logs

Traffic passes through Cloudflare and the hosting infrastructure. The application does not send files to an external conversion or AI service. The origin access log is disabled; error logs may still include technical request information such as IP addresses and URLs. Private API responses use no-store and noindex headers.

What has not been confirmed

Hosting location, provider backup policies, storage encryption and Cloudflare account-level retention settings still require confirmation. We do not claim end-to-end encryption, secure erasure from all backups, independent security certification or absolute protection.

Contact details are being prepared on Contact. Do not send documents or credentials in a security report.