Security
Most online PDF tools ask you to upload a file to a server you know nothing about, and then ask you to trust a policy about what happens to it. Novus PDF Studio removes the question instead of answering it: the document is opened, edited and saved by your own browser, and never travels anywhere.
You do not have to take that on trust. Install the site, switch on airplane mode, and run an export. Work that completes with the network off was never being sent anywhere — no marketing claim can fake that result.
Version 1.1 · Effective August 7, 2026 · Last updated August 8, 2026
Every operation — opening, scanning, editing, encrypting, exporting — runs inside your browser tab using WebAssembly and JavaScript. There is no upload endpoint to breach, no storage bucket to misconfigure, and no retention policy to trust, because there is nothing on our side to retain. This is an architectural property, not an operational promise.
Protect produces genuinely encrypted output using AES-256, applied locally. The password is used in your browser and is never transmitted — which also means nobody, including us, can recover it for you. Store it before you close the tab.
Unlock requires the authorized password and then checks that the result actually reopens without credentials before it hands you the file. A tool that silently produced a still-encrypted document would be worse than one that failed.
The site is served over HTTPS with strict transport security, X-Frame-Options and other enforcing response headers. Its Content Security Policy is deliberately Report-Only during the Patch + Observe stage: it does not block a request, and we do not count it as enforced protection. Advertising and analytics are consent-gated and are structurally incapable of receiving document bytes because document operations never use a network endpoint.
Report-Only is a compatibility and telemetry stage, not a security boundary. The enforced headers above remain active while the candidate CSP is exercised without risking the local editor, workers, offline app or consent-gated services.
These are the distinctions that cause real harm when they are misunderstood — each one is a way someone can send a document believing it is safe when it is not.
Cover mode paints an opaque rectangle while the original content remains in the PDF. Remove mode rasterizes the affected page so the covered source content is not carried into the result, but that also removes selectable text, links and form widgets from the page. Use remove mode for sensitive content and verify the exported PDF before sharing; never describe a white cover as redaction.
AES-256 encryption is enforced by mathematics: without the password, the content cannot be read. Printing, copying and modification flags are different — they are requests recorded in the file that a PDF viewer chooses to honour. A viewer that ignores them is not defeating any protection, because there is none to defeat.
AES-256 does not help if the password is short or guessable. Use at least eight characters, and different open and owner passwords. Encryption strength is not the weak link in practice — password choice is.
Because nothing is uploaded, the security of your document is the security of your machine and browser. That is a better boundary than someone else's server for most people, but it does mean a compromised device is a compromised document, and a shared or public computer deserves the same caution any sensitive work would.
An exported file is an ordinary file on your disk with no special protection. If you exported something sensitive to a shared machine, delete it when you are finished.
If you have found a security issue, email pdf@novusstreamsolutions.com with steps to reproduce. Please report privately first rather than publishing, and give us a reasonable window to ship a fix.
There is no paid bounty programme. Please do not run automated scanning that degrades the service for other people — since every document operation is local, load testing this site tells you nothing useful anyway.
For anything that is not a security issue, use the contact page. Details of what data the site itself collects are in the privacy policy.