Is Safha Safe? Security and Your Files

We don't sell your personal data, we don't show targeted ads, and we use no advertising cookies or third-party tracking cookies. The site's Content Security Policy only lets our pages connect to our own domain (connect-src 'self').

You don't need an account to use the tools. Our analytics are our own: we never store your raw IP address, we turn it into a hashed token using a secret that changes every day. Tool logs never contain your file names or contents, only the tool, where it ran, whether it worked, how long it took and an approximate size range.

The file is read and processed inside your browser, and you download the result from the browser itself. The file is not sent to any server. This covers most PDF and image tools, such as merging, splitting, rotating, signing your own file and compressing images.

Some tools need software that doesn't run well in a browser, such as Office conversions and OCR. Here your file is sent over an encrypted connection to our conversion service, which processes it and erases it as soon as your result is sent.

Summarize PDF, Translate PDF and Ask your PDF extract the text from your file and send that text, not the file, to Anthropic over an encrypted connection. Details are in the AI section. We recommend not using these tools for highly sensitive documents.

When you ask other people to sign a document, we keep it until everyone has signed: the document, the signers' names and emails, and an audit trail of every step. This feature is for account holders only. How long we keep it is under Retention and deletion.

There is no official "GDPR certificate", and we don't claim one. We do apply its principles: we collect as little data as we can, set a time limit on everything we keep, and explain where every file is processed. Your rights include:

• Erasure: delete your account yourself from the "My account" page.
• Rectification: change your name and language on the "My account" page; for anything else, email us.
• Access and portability: ask for a copy of your account data at [email protected].

We apply practices from OWASP's web application security guidance, including:

• Content Security Policy (CSP): scripts and connections are limited to our domain, and the site can't be embedded in other sites.
• SSRF protection: HTML to PDF and HTML to image accept only public http and https links, and we check the IP address on every connection and every redirect, so no request can reach our internal network.
• Isolated rendering: the browser that renders web pages has no direct internet access; each of its requests goes through that same check, and scripts are off by default in uploaded HTML files. Macros in Office files never run, and each conversion runs in its own process with a time limit and a cap on what it can write.

Iraq has the Electronic Signature and Electronic Transactions Law No. 78 of 2012. Signatures in Safha are simple electronic signatures: we keep an audit trail with the time of every step, and a SHA-256 fingerprint of the original and the final document. They are not signatures certified by a certification authority, and we don't give legal advice on their validity. If your document needs a signature with a specific legal standing, consult a legal professional.

• ISO/IEC 27001: building an information security management system to this standard, ahead of an independent assessment.
• An independent penetration test by an outside firm.
• Two-factor authentication for administrator accounts.
• Encryption at rest for signature-request files.

Safha runs on a server rented from Contabo GmbH, whose address range is registered in Germany according to the RIPE NCC registry. Each service runs in its own Docker container managed with Coolify: the website app, the conversion service and a PostgreSQL database.

The site's traffic goes through Cloudflare's network, whose service includes automatic protection against distributed denial-of-service (DDoS) attacks. Inside the server, the database sits on an internal network cut off from the internet, and the conversion service accepts no connections from outside: only the website app can reach it, with a shared secret token.

• The whole site runs over HTTPS, and HTTP requests are redirected to HTTPS.
• Connections support TLS 1.3.
• We send an HSTS header for two years (max-age=63072000; includeSubDomains), so your browser only opens the site over an encrypted connection.
• The connection between Cloudflare and our server is encrypted too, with a valid TLS certificate.

We keep little on the server: accounts, workflows, saved CVs and analytics in the database, and signature-request files on the server's disk. Passwords and signing-link tokens are stored only as hashes (bcrypt and SHA-256). To be clear: today we don't encrypt the database or signature-request files at rest with a key of our own; they are protected by network isolation and server permissions.

Safha has only two roles: member and administrator. The admin dashboard opens only for an account with the administrator role, and we check that role on the server twice: when the dashboard is reached, then on every page and action inside it. Changing an account's role or suspending it ends its sessions immediately.

• The conversion service runs as a non-root user on a read-only file system, and writes only to a temporary in-memory folder.
• It reads its secrets once at start-up, then gives up root privileges; those secrets never reach the conversion processes.
• The Anthropic key lives only in the conversion service; it never reaches the website app or the browser.
• The database password and the session-signing key are generated by the deployment platform; nobody types them by hand.

We don't offer two-factor authentication for administrator accounts today, and we won't claim we do. Until we add it, the first administrator password is generated at random by the deployment platform, and sign-in attempts are limited as for every account.

Actions that reach users' devices, such as sending notifications and publishing app releases, are logged with the administrator's identity and the time.