Ten tools never even send them: they run in your browser. The rest process and return, leaving no copy — no document database, no uploads folder, no backup of your files. The one exception is remote signing, because the document has to wait for whoever signs it, and there it's encrypted with a key we don't have.
The questions a company asks a software vendor —encryption at rest, tenant isolation, who controls the keys— exist because the vendor stores the data. Here we don't answer them better: they don't apply. There's nothing to encrypt if nothing is stored, and no tenant data to isolate.
Elige dos PDF. Se unen en esta página y, mientras, se cuenta todo lo que sale de tu navegador. No hace falta que nos creas: los bytes enviados los cuenta tu propio navegador.
| Peticiones a nuestro servidor con tu documento | — |
| Bytes de tu documento enviados | — |
| Peticiones a terceros | — |
| PDF unido | — |
How to check Merge, split, rotate, extract, remove, reorder, crop, page numbers, watermark and booklet run in your browser. Check it: open the network tab (F12), merge two PDFs and watch the requests. You'll see the code downloading and a 140-byte note with the tool's name. You won't see your document.
The code, with its hash →How to check Not a reduced version: the same operation. Verified by rendering the same PDF both ways and comparing pixel by pixel: zero differences out of 1.4 million pixels.
Modules and hashes →How to check Tools that need a server (convert, OCR, AI) process in memory and return the result. There is no document database, no uploads folder, no backup of your files: the place where they'd be doesn't exist.
How to check The document is encrypted with AES-256-GCM. Its key is wrapped with another derived (HKDF-SHA256) from the secret link the signer and you receive. That key is not in our database: without one of the two links, the stored file is noise. No Biomag employee, no one with server access, and no court order against us can open it: we have nothing to open it with.
How it's built →How to check No third-party scripts: the Content Security Policy blocks them at browser level, not by promise. Check the headers of any page here.
The seven commitments →How to check Email, plan and date. No password —you sign in with a one-time link—, no tracking cookies, no profiles.
Privacy →How to check The app and its data run in the EU. For AI tools you can require EU models with the sensitivity switch.
Plans →Companies ask us these four things and today the answer is no. They're here because a trust page that hides what's missing doesn't win anyone over: it loses them the day they ask.
They're expensive and take months. Biomag doesn't have them today and saying otherwise would be a lie.
Nobody outside has reviewed this code yet. What you can do is review it yourself.
Everything runs on the same infrastructure. For a company needing its own instance, that's a conversation, not a checkbox.
It's where the document stays stored for a while. Elsewhere there's nothing to encrypt at rest, because there is no rest.
Do you need any of the below to work with us? Write to us: hola@biomag.es