# Trust

Security, privacy, and legal documentation for PDF Blocks in one place: how the API handles your documents, who our subprocessors are, and the terms you contract under.

Everything a security, privacy, or procurement reviewer needs to evaluate PDF
Blocks lives in this section. If you are here to answer a questionnaire, start
with the [Security overview](/docs/trust/security); if you are here to sign,
start with the [Terms & Conditions](/docs/trust/terms) and the [Data Processing
Addendum](/docs/trust/dpa).

Two structural facts shape almost every answer below:

- **We never store your documents.** The API processes each file in memory and
  returns the result in the same response. Nothing is written to a database or
  durable storage.
- **The pipeline is deterministic, with no LLMs.** Every action is document
  manipulation implemented in code. No large language model reads your
  documents, and nothing you send us trains a model.

## Security & compliance

<CardGroup cols={3}>
  <Card title="Security overview" icon="key-round" href="/docs/trust/security">
    How documents are handled, encryption, API-key authentication,
    infrastructure and network isolation, regions, vulnerability management, and
    a control mapping to the SOC 2 Trust Services Criteria.
  </Card>
  <Card title="HIPAA" icon="file-text" href="/docs/trust/hipaa">
    Processing PHI under a signed Bonterms BAA, routed to our dedicated US
    HIPAA endpoint, on a pipeline that leaves no PHI at rest.
  </Card>
  <Card title="Subprocessors" icon="file-text" href="/docs/trust/subprocessors">
    Every third-party provider we rely on, with its purpose, the data it may
    access, and where it operates. Document contents are shared with none of
    them.
  </Card>
</CardGroup>

## Legal

<CardGroup cols={3}>
  <Card title="Terms & Conditions" icon="file-text" href="/docs/trust/terms">
    The agreement governing your use of PDF Blocks.
  </Card>
  <Card title="Privacy Policy" icon="file-text" href="/docs/trust/privacy">
    How we collect, use, and protect personal data.
  </Card>
  <Card title="Data Processing Addendum" icon="file-text" href="/docs/trust/dpa">
    Our processor commitments, with EU Standard Contractual Clauses and CCPA
    terms. Available to business customers.
  </Card>
</CardGroup>

## Documents you can request

- **[Security Whitepaper (PDF)](/pdf-blocks-security-whitepaper.pdf)** is a
  shareable summary of the security overview. No request needed, download it
  directly.
- **Internal security policies** covering information security, access control,
  cryptography, data protection and retention, vulnerability management, secure
  development, incident response, and business continuity are available on the
  Business plan, to customers and prospects, under a mutual NDA.
- **A completed security questionnaire** is available on the same terms, and we
  are glad to fill in yours.

## Contact

Email [security@pdfblocks.com](mailto:security@pdfblocks.com) for anything in
this section: a control that is not covered here, a document request, or a
vulnerability report. Our machine-readable contact details are published at
[/.well-known/security.txt](/.well-known/security.txt).