Blog

Is iLovePDF safe for sensitive documents?

Is iLovePDF safe? For everyday files, yes, by its own published standards. The Barcelona-based company says it is GDPR compliant, holds ISO/IEC 27001:2022 certification, encrypts files in transit and at rest, and deletes processed files within two hours. Your file still travels to its servers, though, so for IDs, medical records, legal papers, or client data, the real question is whether you are allowed to upload that file at all.

This post sets out what iLovePDF says about itself, how upload-based and on-device tools differ, and a short checklist for sensitive files. If the answer is “don’t upload,” RealScaner runs its scanner and PDF tools inside your browser instead. Every claim about RealScaner below was checked against its source code.

What iLovePDF says about security

iLovePDF is run by ILOVEPDF, S.L., registered at Calle Sabino de Arana 60, Barcelona, Spain, according to its privacy policy (last revised February 19, 2026). Its security page, titled “iLovePDF Security & Data Protection,” makes these claims:

The privacy policy adds two useful details. For files you upload, iLovePDF says it “will act as a data processor,” which means you, not iLovePDF, decide what goes in. It also states that it does not use your content to train, improve, or develop its AI models. Processing generally stays inside the European Economic Area. For users outside it, data may be processed in nearer regions under EU adequacy decisions or Standard Contractual Clauses.

One small inconsistency is worth knowing. The security page and privacy policy time the two-hour window from processing. iLovePDF’s 2023 blog post says files are deleted “within 2 hours of upload.” Either way, the file sits on a server for a short time unless you delete it yourself.

How to delete files from iLovePDF

You do not have to wait two hours. iLovePDF’s post “Is iLovePDF safe? How to instantly delete files from iLovePDF” describes the manual route:

  1. Run your task as usual, for example merge or compress.
  2. Stay on the download page when the task finishes.
  3. Select the Delete it now button on the right side of that page.
  4. Download your result first if you still need it. The server copy is gone after deletion.

The same post says that “no one, including iLovePDF, can access your files while they are on our servers.” That is the company’s own statement. An ISO 27001 certificate shows an audited security management system. It does not show what happens to a specific file, so treat vendor claims as promises backed by a contract and a regulator, not as proof.

Is iLovePDF free?

Yes. iLovePDF has a free Basic plan with per-task limits. Its pricing page lists, for example, up to 25 files and 100 MB per Merge PDF task, up to 2 files and 200 MB per Compress PDF task, and 1 file per Split PDF or Word to PDF task. The comparison table marks an ad-free service as a Premium feature, so expect ads on the free plan. Prices show in local currency, so check the page for your region.

Are online PDF tools safe?

Most reputable online PDF tools are safe for ordinary files. The risk is not that they are malicious. The risk is in the model itself. There are two ways a PDF tool can work:

Neither model makes a bad habit safe. A shared computer, a synced downloads folder, or the portal you send the result to can all expose a file. Our guide on what stays on your device with browser document tools covers those edges.

Is iLovePDF safe for confidential or sensitive documents?

That depends less on iLovePDF and more on you and the file. Run through this checklist before you upload anything sensitive to any online service:

  1. Whose data is it? Your own lease is your call. A client’s tax return, a patient’s chart, or an employee’s ID is someone else’s data that you are responsible for.
  2. What does your employer allow? Many workplaces ban unapproved cloud tools for company files. If you are not sure, ask IT before you upload.
  3. Does HIPAA apply? Under 45 CFR 164.502(e), a covered entity may disclose protected health information to a business associate only after it “obtains satisfactory assurance” that the information will be safeguarded. In practice, that means a written business associate agreement. A free, anonymous web upload does not give you one, so ask the vendor or your compliance team first.
  4. Does GDPR apply? If you process other people’s personal data for your business, you are the controller. The European Commission’s GDPR guidance says outsourced processing needs a contract and a processor that “provides sufficient guarantees” of appropriate safeguards. iLovePDF publishes a data processing agreement as an appendix to its privacy policy. Check whether it covers your use.
  5. How bad is a leak? Passports, bank statements, and signed contracts deserve more caution than a flyer or a class handout.
  6. Can you avoid the upload? If any answer above is “not sure,” use a tool that works on your device.

Phone scanner apps raise the same questions. We look at one in is CamScanner safe.

Is Smallpdf safe?

Smallpdf is iLovePDF’s closest rival, and its claims are similar. Its security page, titled “Smallpdf Security,” says Smallpdf is ISO/IEC 27001 certified, complies with GDPR, CCPA, and Switzerland’s nFADP, and uses TLS encryption during file transfer. The company is based in Zurich. Users with a free or paid account can store documents online, and the page says that storage can be turned off. It also says file data is accessed only in limited ways, such as support requests or technical issues.

One line on that page is a fair summary of this whole topic: “Some documents shouldn’t be processed online or saved to the cloud.” For those, Smallpdf points to its desktop app for Windows. iLovePDF also lists desktop apps for Mac and Windows.

What is the best alternative to iLovePDF?

For sensitive files, the best alternative is one that never receives the file. RealScaner is a free, no-account option that does this in the browser. Uploading a client’s ID to a stranger’s server just to shrink it feels wrong, and it is often against policy. On RealScaner, these jobs stay on your device:

What we checked in RealScaner’s code

The PDF and image logic lives in files such as pdf-compressor.js, pdf-structural-tools.js, and image-tools.js. They use the open-source libraries pdf-lib and PDF.js, which are bundled with the site and run in your browser. None of the tool code makes a network request with your file. The site’s server code, worker.js, does three things: it serves the site’s pages and scripts, redirects HTTP to HTTPS, and delivers the contact form to our inbox. It has no route that accepts documents.

Analytics and ads are off by default. Google Analytics loads only after you allow analytics in the consent banner, and Google ads load only after you allow advertising and your browser is not sending a Global Privacy Control signal. If you allow analytics, tool events record counts and sizes, such as how many files, how many bytes, and which preset. The code excludes file names and file contents from those events.

How to check whether any PDF tool is really on-device

You do not have to take any website’s word for it, including ours. Two tests take a few minutes.

The DevTools Network test

  1. On a computer, open the tool page in Chrome or Edge.
  2. Press Ctrl+Shift+J on Windows or Cmd+Option+J on Mac, then open the Network tab. DevTools only logs requests while it is open.
  3. Process a test PDF of a known size, for example 2 MB.
  4. Look for an outgoing request (often POST or PUT) about that size. Click it and check the size and payload. If none appears and the result still downloads, the work happened on your device.

The offline test

  1. Open the tool and run it once on a harmless test file. Some tools load their processing code on first use.
  2. Turn on airplane mode or switch off Wi-Fi.
  3. Run the tool again on another file. An upload-based tool fails here. An on-device tool still finishes.

Use both. The offline test is easy, and the Network tab shows exactly what left the browser.

What on-device processing covers

On-device processing removes the upload. A device with malware, a shared login, or a downloads folder that syncs to the cloud still needs its own care. RealScaner keeps the document work itself in your browser: scanning, compressing, merging, organizing, watermarking, and numbering pages, unlocking a PDF once you enter its password, placing a visible signature image with the Signature maker and Sign PDF, and reading printed English text from images with Image to Text. Compress PDF saves each page as a compact JPEG image, which suits scans. None of it needs an upload.

Sources

Key takeaways

Common questions

Is iLovePDF safe to use?

For everyday files, iLovePDF is a reasonable choice. Its security page says it is GDPR compliant, holds ISO/IEC 27001:2022 certification, encrypts files in transit and at rest, and deletes processed files within two hours. Your file is still uploaded to its servers, so treat it as a third-party service.

Is iLovePDF safe for confidential documents?

It depends on who the data belongs to and what rules apply. If an employer policy, a client contract, HIPAA, or GDPR covers the file, check that the upload is allowed before you use any online PDF service. If you cannot confirm that, use a tool that processes the file on your device.

Is iLovePDF free?

Yes, iLovePDF has a free Basic plan with per-task limits. Its pricing page lists, for example, up to 2 files and 200 MB per Compress PDF task and up to 25 files and 100 MB per Merge PDF task. Ad-free use is a Premium feature.

How do I delete files from iLovePDF?

After a task finishes, select the Delete it now button on the right side of the download page. iLovePDF says this removes the file from its servers right away. If you do nothing, it says files are deleted automatically within two hours.

Is Smallpdf safe?

Smallpdf’s security page says it is ISO/IEC 27001 certified, complies with GDPR, CCPA, and Switzerland’s nFADP, and uses TLS encryption during file transfer. Like iLovePDF, it processes files on its servers, and it offers a Windows desktop app for documents that should not go online.

How can I tell if a PDF tool uploads my file?

Open your browser’s DevTools, go to the Network tab, and run the tool on a test file. A large outgoing request around the size of your file means it was uploaded. You can also run the tool once, switch off Wi-Fi, and check whether it still works.

Published October 21, 2026. Updated October 21, 2026.

Keep reading

Tools: scanner · all tools · all posts · guides