Your documents,
in a safe place.
Hosting in France, encryption, two-factor authentication, GDPR compliance. Security is the ground the rest stands on.
- hosting.locationFrance 100%
- hosting.residencyEuropean Union
- crypto.on_uploadGPG · AES-256
- crypto.fingerprintSHA-512
What we actually commit to
- 01
Hosted in France
Your files are stored and processed on servers located in France. The content of your documents does not leave the European Union.
- 02
GDPR compliant
Minimal data, rights of access and erasure, export. You delete your account and everything in it whenever you want.
- 03
GPG encryption
Encrypt your documents on upload with AES-256 or Twofish, on the server. Your archives stay unreadable without your key.
- 04
Two-factor authentication
Protect access with a PIN code, a one time code (TOTP) or a passkey. A passkey is Face ID or Touch ID on an Apple device, Windows Hello on a PC, the unlock of your Android phone, or a physical security key.
- 05
Permanence
Files dated and kept over time. Automatic deletion only if you ask for it.
- 06
Private by default
Nothing is public without an action from you. You decide on every link, password and expiry.
- 07
The lasting PDF/A format
For documents to keep for a long time, convert them to the standard PDF/A format (ISO 19005), designed to stay readable over time. Convert to PDF/A, free of charge, processed in France.
- 08
Verifiable integrity
Every file receives a SHA-512 fingerprint on upload. You can check at any time that a document has not been altered since it was filed.
- 09
Nothing stays with the visitor
When somebody reads a document you shared, its pages are served with a no-store instruction: the browser does not write them to its cache. Once the tab is closed, nothing is left to find on the machine, beyond what the person downloaded or captured themselves.
Your documents stay in France
Servers in France
Your files are stored and processed in France, with a redundant backup kept inside the European Union.
Documents inside the EU
The content of your documents does not leave the European Union. The few third party technical services (payment, email) never have access to it.
A French publisher
Published by a sole trader established in France (e.i. Valentin Beck, Strasbourg).
- Hosted in France100%
- EncryptionGPG
- Data inside the UnionEU
- ComplianceGDPR
How the service is run
Dedicated physical machines
The service runs on dedicated physical hardware, at French hosts, outside the large American clouds. No other customer shares the machine that holds your documents. It is operated by Permalink, the Linux operations business of the same publisher.
Encrypted link between servers
The servers talk to each other through a WireGuard tunnel, on an encrypted private network. Administration goes through SSH, by key only: the server accepts no password. On the visitor side, everything is HTTPS.
No third party dependency
The public pages load no script, no font and no image from a third party, and set no cookie. No analytics, so no banner to refuse.
What we never do
- 01No advertising
- 02No reselling of your data
- 03No advertising use and no profiling
- 04No transfer of your documents outside the EU
- 05No lock-in: free export, open formats
- 06No access to your encrypted files
- 07No alteration of your filed documents
- 08No analytics and no tracker
What this service is not
PDF Archive is not a digital safe in the legal sense of the term: the service is certified under no archiving standard, it is qualified by no national security agency, and it does not replace an approved trusted third party. It offers a level of security in line with the state of the art in hosting. That is what it takes to keep documents for years. It is not the same thing as a certification.
A filed document is never rewritten: what you download is, byte for byte, what you sent, and the SHA-512 fingerprint proves it. The only transformations possible are the ones you ask for, such as stripping the metadata from a published document, and they apply to the shared copy, not to your archive.
For a file you may need to rely on in court, a certified service remains the right tool. For keeping, finding and sharing your documents for years without handing them to a platform that lives on advertising, this one does the job.
Reporting a security flaw
Security testing on PDF Archive is authorised within the frame described below. Write to us through the contact page; we acknowledge receipt and keep you informed of the fix. Research carried out within this frame will never be held against you.
What you may do
- 01Look for application flaws on www.pdf-archive.com and my.pdf-archive.com.
- 02Test from an account you created for the purpose, with your own documents.
What you may not do
- 01Degrade the service: load testing, denial of service, mass sending, altering or deleting data.
- 02Reach the data of another account, read it, copy it or keep it. If you come across it by accident, stop immediately and tell us.
- 03Target people rather than the service: phishing, social engineering, approaching our suppliers.
How we proceed
- 01You tell us the result first, before any public disclosure.
- 02You leave at least 72 hours between our acknowledgement and a publication, so that we can fix the problem or warn the people concerned.
- 03We pay no bounty: the service is published by a sole trader. We are glad to credit, on request, the people who report a flaw to us.
This information is also published in the standard format (RFC 9116) at /.well-known/security.txt. To report unlawful content rather than a flaw, see the terms of use.
Your questions
Who can see my documents?
You alone, by default. A document only becomes reachable if you create a public link, which you can protect with a password and let expire.
Where is the data stored?
Your documents are stored on servers in France, inside the EU, and they do not leave. The few third party technical services (payment, sending email) never have access to their content.
Is the encryption end to end?
GPG encryption (AES-256 or Twofish) is applied on upload, on the server. Your encrypted files are unusable without the key.
Does the site use cookies or trackers?
The public site sets no cookie and carries no analytics tool. Inside your account there are four technical cookies only: the one that keeps you logged in, the one that lets you switch between accounts, the one that spots the browser closing for that switcher, and the one that resumes an interrupted import. The first keeps you logged in for 30 days without activity by default, and you can shorten that in your security preferences. Each of them is detailed in the privacy policy.
How do I check that a document has not moved?
Every file receives a SHA-512 fingerprint at the moment of upload, shown on the document page and present in the export of your account. Recompute it on your copy: if the two strings are identical, so are the files. A filed document is never rewritten.