Security and Trust: What Leaves Your Device, What Never Does

The short version

Every one of the 47 tools processes the PDF on your device. There is no server-side document code: the site is static files on Cloudflare Pages.
Three optional features move a document off your device, and only as ciphertext you sealed yourself: secure handoff links, signature requests and team review. The key travels in the link fragment, which browsers never send to a server.
Accounts, Teams and Pro exist so plans and shared settings can follow you. They handle identity and entitlements, never documents.
Telemetry is two things: Cloudflare Web Analytics (cookieless page views) and daily usage counts (an event name, a tool name, a number) that you can switch off in the footer. Neither carries an identifier.
You can check all of this yourself: the proof panel in the app logs every request the tab makes, the verify page shows how to confirm it in DevTools, and status.binderypdf.com watches the optional services every five minutes.

Data flow

Every service Bindery talks to

Service	When	What it receives	What it never receives
Cloudflare Pages	Every visit	Requests for the app's files: HTML, scripts, fonts, the vendored PDF engines, sample files. Standard access logs (IP address, user agent) under Cloudflare's policies.	Any document. There is no upload endpoint.
Cloudflare Web Analytics	Every page view	A cookieless page-view beacon: URL, referrer, browser and performance timings. No cookies, no fingerprinting, no cross-site tracking.	Identifiers, file names, tool inputs.
Usage counts (this origin, `/_a`)	While you use the app, unless switched off	Daily totals per event and tool — "merge opened 12 times today". The endpoint adds numbers to one row per day and stores nothing about the request. Honours Global Privacy Control and Do Not Track.	Who you are, what the file was called, how big it was, what was in it.
Supabase Auth	Only if you sign in	Your email address, or an identity token from Google or Microsoft, or a SAML assertion from your company's identity provider for Teams SSO.	Documents, tool usage, file names.
Supabase database	Signed-in use	Subscription status, the daily job count for signed-in users (date and number only), team membership and shared settings, review marks (shapes and notes, not pages), the team audit log (who changed which setting).	Documents. Every table has row-level security; browsers only ever hold a publishable key.
Supabase Storage (package broker)	Handoff links, signature requests, team review	A package sealed on your device with AES-256-GCM plus SHA-256 hashes of each version. The broker functions check plans and expiry; they cannot decrypt anything because the key was never sent to them.	The key, the plaintext, or any way to derive them.
Timestamp authority (DigiCert)	When you ask for a trusted timestamp	An RFC 3161 request containing a SHA-256 hash of the signature value, forwarded by a small proxy so the browser can reach it. The reply is a signed token embedded in your PDF.	The document, the signature itself, your identity.
Stripe	Buying Pro or Teams	Your payment details, entered on stripe.com. Bindery receives a signed webhook saying a subscription exists.	Card numbers. They never touch Bindery or Supabase.
Google and Microsoft	Only if you choose them to sign in	A standard OAuth sign-in on their pages; Bindery learns your email address and a stable identifier.	Anything about your documents. Bindery asks for no Drive or OneDrive scopes.
Your AI provider	Only if you configure one	The excerpts you choose to send from "Ask your PDF", to the endpoint you configured (OpenAI, Groq, OpenRouter, Mistral, or a local Ollama). On-device models are downloaded from Hugging Face once and run in the browser.	Anything, until you configure it. The default is on-device.
Phone scan	Only while you scan from a phone	The phone and the desktop exchange connection details, then move the pages over a WebRTC data channel encrypted with the key from the QR code.	Pages on any server.

How the optional services are built

Static site, strict CSP. The content-security policy allows scripts only from this origin (plus Cloudflare's analytics beacon), connections only to the services listed above, and no framing. Every engine — the PDF library, pdf.js, Tesseract — is served from binderypdf.com, not a CDN, so the code you run is the code we published.
Readable code. The scripts are shipped unminified. Open DevTools and read them; the proof panel in the nav is the first script to load so nothing can escape its log.
Row-level security everywhere. Every table is locked by policy; the browser holds a publishable key that only grants what the policies allow. Edge functions verify your session token and use the service role only inside their own code.
Brokers with expiry and caps. Packages expire, are removed when downloaded out, and are swept hourly by a scheduled job. Signature requests are capped at 3 a month on the free plan and 50 a day for anyone; handoff links at 100 a day; anonymous broker actions are throttled per minute; marks, audit entries and shared assets have size limits enforced in the database.
Signatures you can verify anywhere. Certification signatures are made with keys generated non-extractable in Web Crypto, or with a .p12/.pfx you decrypt on the device. The result is a standard PDF signature with the certificate chain embedded, which Acrobat, Preview and Bindery's own Verify tool can check.
Offline-capable. Once loaded, the app works without a network. If a feature needs a service it says so before it starts.

Retention

Data	Where	Kept for
Documents you process	Your device only	Until you close the tab, or longer only if you turn on "keep recent outputs", which stores them in your browser.
Handoff packages (ciphertext)	Supabase Storage	1–30 days as you chose (default 7) or until the download cap, whichever first; expired packages are deleted on the next request and by an hourly sweep.
Signature-request packages (ciphertext)	Supabase Storage	1–60 days as you chose (default 14); the sealed package is deleted when the last signer completes, and the record holds only hashes and the event log.
Team review sessions	Supabase database	30 days, then purged by a scheduled job; the document itself is a handoff package with its own expiry.
Daily job counts (signed in)	Supabase database	40 days. Anonymous counts live in your browser's IndexedDB.
Account, subscription, team membership	Supabase and Stripe	Until you delete the account (email support) or cancel; Stripe keeps its own transaction records as the law requires.
Usage counts and Web Analytics	Cloudflare	Daily aggregates with no identifiers; kept to see which tools matter.
Access logs	Cloudflare, Supabase	Their standard operational retention.

Subprocessors

The companies that run infrastructure for Bindery, and the narrowest description of what they process.

Cloudflare — hosting, DNS, TLS, Web Analytics, the status page, the usage-count database, and email routing for support@.
Supabase — authentication, the database behind accounts and Teams, storage for sealed packages, and the edge functions that broker them.
Stripe — payments and subscriptions.
DigiCert — the RFC 3161 timestamp authority; receives a hash.
Google, Microsoft — only as sign-in providers, only if you pick them.
Your AI provider, Hugging Face — only if you turn on AI features; Hugging Face serves model files and receives no document data.

Verify it yourself

Open any tool, run a job, and press the green chip in the nav: the proof panel lists every request this tab made and the done screen says "0 uploads during this job".
Follow the verify page to confirm the same thing in your browser's Network panel, offline.
Watch status.binderypdf.com: the optional services are checked every five minutes, including a real timestamp request every hour.
Read the changelog: every entry is live on the site the day it appears.

Report a vulnerability

Email [email protected] with "Security" in the subject. Include what you found, how to reproduce it and what you think the impact is. Every report gets a reply from the person who wrote the code, and fixes are noted in the changelog with credit if you want it. Good-faith research against your own account and files is welcome; please do not read other people's data, run load tests against the brokers, or use the timestamp proxy as a free service. There is no paid bounty programme yet.

Changes to this page

This page is generated with the site, so the date at the top is the last time its content changed. Material changes to what a service receives are also announced in the changelog and reflected in the privacy policy.

What leaves your device, and what never does