Ten tools never even send them: they run in your browser. The rest process and return, leaving no copy — no document database, no uploads folder, no backup of your files. The one exception is remote signing, because the document has to wait for whoever signs it, and there it's encrypted with a key we don't have.
The questions a company asks a software vendor —encryption at rest, tenant isolation, who controls the keys— exist because the vendor stores the data. Here we don't answer them better: they don't apply. There's nothing to encrypt if nothing is stored, and no tenant data to isolate.
Elige dos PDF. Se unen en esta página y, mientras, se cuenta todo lo que sale de tu navegador. No hace falta que nos creas: los bytes enviados los cuenta tu propio navegador.
| Peticiones a nuestro servidor con tu documento | — |
| Bytes de tu documento enviados | — |
| Peticiones a terceros | — |
| PDF unido | — |
How to check Merge, split, rotate, extract, remove, reorder, crop, page numbers, watermark and booklet run in your browser. Check it: open the network tab (F12), merge two PDFs and watch the requests. You'll see the code downloading and a 140-byte note with the tool's name. You won't see your document.
The code, with its hashHow to check Not a reduced version: the same operation. Verified by rendering the same PDF both ways and comparing pixel by pixel: zero differences out of 1.4 million pixels.
Modules and hashesHow to check Tools that need a server (convert, OCR, summarise, translate) process in memory and return the result. There is no document database, no uploads folder, no backup of your files: the place where they'd be doesn't exist.
How to check The document is encrypted with AES-256-GCM. Its key is wrapped with another derived (HKDF-SHA256) from the secret link the signer and you receive. That key is not in our database: without one of the two links, the stored file is noise. No Biomag employee, no one with server access, and no court order against us can open it: we have nothing to open it with.
How it's builtHow to check No third-party scripts: the Content Security Policy blocks them at browser level, not by promise. Check the headers of any page here.
The seven commitmentsHow to check Email, plan and date. No password —you sign in with a one-time link—, no tracking cookies, no profiles.
PrivacyHow to check The app and its data run in the EU. For text-processing tools you can turn on the sensitivity switch: then the text never leaves the EU.
PlansDoes your company need anything else to work with us? Write to us: hola@biomag.es