Trust and Security
Reviewed 2026-09-13.
This page exists so that an IT or security team can evaluate OneClickPDF without having to ask us anything first. It states what the service is, where it runs, how it is secured, what happens to a document you send it, and exactly what has to be allowed through a filter for it to work. Reviewed 2026-09-13.
Service identity
| Service | OneClickPDF, a document conversion and PDF processing service |
|---|---|
| Operator | Developed and operated under the 13DevLab identity |
| Website | https://oneclickpdf.app |
| API and agent endpoint | https://api.oneclickpdf.app |
| General and legal contact | contact@oneclickpdf.app |
| Product support | support@oneclickpdf.app |
| Security reports | contact@oneclickpdf.app, and /.well-known/security.txt |
Infrastructure
OneClickPDF runs on infrastructure located in the European Union.
| Hosting | OVHcloud. The application, the document conversion workers and the authoritative PostgreSQL database run on the same provider |
|---|---|
| Database | PostgreSQL 17, on the same infrastructure, with encrypted off-host backups |
| DNS and bot protection | Cloudflare provides domain name resolution and the Turnstile challenge used to keep automated abuse off the free conversion endpoints |
| Payments | Stripe, and only on the pages where a purchase is made |
| Transferring outside the EEA | Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission’s standard contractual clauses. The detail is in the Privacy Policy |
OneClickPDF holds no security certification, and this page claims none. Where a control is listed below it is because it is implemented, not because it has been audited by a third party.
Accounts, authentication and sessions
There is no password to steal, phish or reuse, and the browser never holds a credential that a script could read.
| Sign-in | A WebAuthn passkey, or a one-time code sent by email. No password, and no social identity provider |
|---|---|
| Session credential | An opaque server-side session. The browser receives a random identifier in a __Host-ocp_session cookie marked HttpOnly, Secure and SameSite=Strict; the session itself lives in the database |
| Browser storage | No token, no API key and no session data is written to localStorage or sessionStorage. The CSRF token lives in a JavaScript variable for the lifetime of the page and is never persisted |
| CSRF | Two independent layers on every state-changing request: an origin allow-list, and a token bound to the session row |
| Normal session | Ends after 60 minutes of inactivity, and cannot last longer than 12 hours however active it is |
| Trusted device | A user may mark their own device as trusted at sign-in, which extends the session to at most 15 days. It is never inferred from the device, the network or the operating system, and it is never indefinite |
| Sensitive actions | Changing security settings, creating an API key or changing the account email requires a fresh passkey or code within 10 minutes. A trusted device does not bypass this |
| Revocation | Signing out, revoking a session from the account page, or revoking all sessions takes effect immediately for every request that follows |
| API keys | Stored only as a hash, shown once at creation, scoped, and revocable. A key never opens a browser session and a session never authenticates the machine API |
What happens to your documents
OneClickPDF is a processing service, not a storage service. It is worth being precise about that, because the usual phrasing is not true of any converter that uses an office engine.
| Accepted uploads | 18 formats: csv, doc, docx, html, jpeg, jpg, md, odp, ods, odt, pdf, png, ppt, pptx, rtf, svg, xls, xlsx |
|---|---|
| Size limit | 100 MB per upload, enforced by the server |
| Processing | Most PDF operations are performed on the uploaded bytes without writing them out. Conversions that need LibreOffice or the HTML rendering engine do write the upload to a temporary directory on the server, because those engines read from disk |
| Deletion | Temporary files are deleted when the operation finishes, on the failure paths as well as the successful one. They are working copies for the duration of one request, and no feature reads them afterwards |
| Generated files for agents | A file produced for an MCP or agent client is served from a single-use link that expires 30 minutes after it is created |
| Logging | File size, format and the result of the operation are logged. File contents are not |
| Training | Documents are not used to train models and are not sold or shared for anyone else’s purposes |
The wording above is deliberate. Conversions that go through an office or page-rendering engine do write the upload to a temporary directory, so OneClickPDF does not describe itself as untouched by disk. A check in the build refuses to publish any page that says otherwise.
Transport and browser protections
| Transport | HTTPS only, on both the website and the API, with HTTP redirected |
|---|---|
| HSTS | Sent by the API with a one-year max-age including subdomains |
| Content Security Policy | The public site restricts scripts to its own origin and a named set of providers. The site contains no inline scripts and no inline event handlers, which is what lets the policy stay strict. The API sends default-src ‘none’ |
| Other headers | X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy denying camera, microphone and geolocation |
| Rate limiting | Per-IP limits on conversion and authentication endpoints, per-address and global limits on sign-in emails, and a daily cap on anonymous conversions |
Allowlisting OneClickPDF
For the service to work, two first-party domains have to be reachable over HTTPS:
oneclickpdf.app: the website and its static assetsapi.oneclickpdf.app: the API, and the MCP endpoint used by agent clients
One third-party domain is needed for document conversion, because it serves the anti-automation challenge in front of the free endpoints:
challenges.cloudflare.com: Cloudflare Turnstile
The following are optional. Blocking them leaves the service fully functional, and it is reasonable for a managed environment to block all of them:
js.stripe.comandapi.stripe.com: only on the pricing and checkout pages, and only if you buy somethingwww.googletagmanager.comand the Google Analytics endpoints: audience measurement, which runs only after a visitor consents- Google advertising domains: advertising, which also runs only after consent
A filtering product that categorises by content type will usually place OneClickPDF under document conversion or online productivity tools. It is not file sharing and not online storage: there is no way to store a document here, share one with another person, or retrieve one later.
What this page does not claim
Whether an external document-processing service may be used inside a particular organization is that organization’s decision, and a legitimate one either way. Data-loss prevention rules, upload restrictions and procurement policy are yours to apply, and nothing here overrides them.
What this page is for is to make that decision answerable: to show what the service does with a document, which controls exist, and exactly what would have to be permitted. If something you need to evaluate is missing, ask at contact@oneclickpdf.app and it will be added here rather than answered privately.
Reporting a vulnerability
Send security reports to contact@oneclickpdf.app, marking the subject as a security report. Please include what you did, what happened, and what you think the impact is. We aim to acknowledge a report within 48 hours.
Testing against the live service must stay within the published rate limits and must not
involve denial of service, or any attempt to reach another user’s documents or account.
The machine-readable version of this contact is at
/.well-known/security.txt.
Related pages
- Privacy Policy: what is processed, on what basis, for how long, and your rights
- Legal Notice: publisher, hosting and intellectual property
- Cookie Policy: what is set, and how to change your choice