Privacy
Your documents are
none of our concern.
VellumPDF is a PDF suite where privacy is not a marketing promise, but a technical impossibility to do otherwise.
The mechanics
How this is possible.
Every VellumPDF tool is written in JavaScript and WebAssembly, two languages your browser can run entirely on its own, without sending anything outside. When you open a tool, it is the program that travels to you, never the other way around.
In concrete terms: when you drop in a PDF, it is your own computer’s processor that reads it, modifies it, and reassembles it. No VellumPDF server is involved in this operation, for the simple reason that it has nothing to do there. Close your tab, and everything reverts to how it was: nothing was kept, nothing was transmitted.
The proof, in 10 seconds
Would rather not take our word for it? Check it yourself — no technical skills required.
- 1Open your browser’s developer tools (keyF12).
- 2Click the Networktab.
- 3Process a PDF with any VellumPDF tool.
- 4Noticethat no request leaves with your file — the list stays silent throughout the whole operation.
You can also read the code instead of taking our word for it: the processing engine is published under the MIT licence, at github.com/dogbe-multisystem/vellum-engine.
A first, declared exception: the models of the assistant and of text recognition
The local PDF assistant needs a language model. On first use, and only after you click “Download the model”, your browser downloads it from huggingface.co, with its runtime from raw.githubusercontent.com (about 850 MB, or 2.2 GB for the more accurate version), then keeps it in its cache. This download goes one way only: nothing from your document is sent. The network witness shows it on a separate line, and a button removes the model from your device.
Text recognition (OCR) includes the site’s languages, whose models vellumpdf.ch serves itself. For any other language, on first use and after the notice shown before you start, your browser downloads that language’s model from raw.githubusercontent.com, where the Tesseract engine publishes its official models (0.4 to 12 MB depending on the language, 2 to 3 MB in most cases), then keeps it in its cache. This download also goes one way only: nothing from your document is sent, and the network witness shows it on a separate line. PDF conversions do the same for the font of a Chinese, Japanese or Korean document: 10 to 18 MB, downloaded once from the Google Fonts repository on the same host and announced before you click. Clearing the site’s data in your browser removes these models and fonts.
A second exception: the two device-transfer messages
For the device-to-device transfer, two small pairing messages, encrypted in your browser, pass through vellumpdf.ch (/api/relais): they are kept for five minutes at most, then erased, and unreadable to our server since the decryption key stays in the QR code. Each device also asks a Cloudflare STUN server for its public address. The files themselves go directly from one device to the other and never pass through our servers.
A third, optional exception: timestamping a signature
If you tick the timestamp option when signing with your certificate, your browser sends the SHA-256 hash of the signature, 32 bytes, through vellumpdf.ch (/api/timestamp) to DigiCert’s timestamping authority, which returns a dated token. Neither the document, nor a page, nor your certificate, nor your password is sent; the relay keeps nothing. The option is off by default.
The guarantees
What we do not do.
No uploading
Your files never pass through a server, not even ours. There is, quite literally, no network route for them.
No account
No registration, no password, no email address required to use a tool.
No tracking cookies
No advertising or analytics tracker follows your browsing from one site to the next.
No advertising
Without an ad network, there is no commercial reason to collect even the slightest profile on you.
No data resale
We sell and rent no data, to anyone. Your documents never reach us, and the little data we do hold elsewhere — billing, correspondence — serves that purpose alone.
No content analysis
The content of your documents is neither read, nor indexed, nor used to train anything.
Compliance
Compliant by design, not by contract.
GDPR (European Union)
The GDPR governs the collection and processing of personal data. For the documents you process with our tools, VellumPDF collects nothing: they never leave your device — so there is nothing to secure on a server, and nothing that could leak in the event of a breach. The little data we do process elsewhere — billing, correspondence, hosting logs — is described below.
FADP (Switzerland)
The revised Swiss Federal Act on Data Protection (FADP) imposes the same rigorous requirements. For documents processed with the tools, our answer is unambiguous: none of them ever reaches our infrastructure, whichever tool is used. For everything else — license purchases, emails, website hosting — we process the strict minimum, detailed in the next section.
Suited to the most sensitive documents
This architecture is not a technical detail: it is what makes VellumPDF usable where an ordinary online suite should not be.
- Contracts and legal instruments
- Payslips and accounting documents
- Medical records and results
Transparency
What we do process, nonetheless.
The promise that nothing leaves your device applies to the documents processed by the tools. Around them, three situations lead us to hold personal data — here they are, plainly.
Purchasing a Cabinet license
Payment is handled by Stripe Payments Europe, Limited (Ireland). From Stripe we receive the billing details — firm name, email address, amount paid — needed to issue the invoice and the processing record. We keep them for as long as Swiss accounting law requires.
Emails sent to contact@vellumpdf.ch
If you write to us, we keep your message and your address for as long as it takes to handle your request and follow up on our exchange. Nothing else is done with them.
The hosting provider’s technical logs
The website is hosted by Vercel Inc. (United States). Like any hosting provider, Vercel records technical logs on each visit, which include your IP address. These logs serve the security and operation of the website; we do not use them to identify you. The same host provides us with aggregated audience figures (page views, tool used, country, device type), with no cookie and no persistent identifier, which follow no one from one site to the next and never concern the name or content of your documents.
Data controller and your rights
The controller for this data is:
DOGBE MULTISYSTEM — Edem Dogbe
Route de Veyrier 46, 1227 Carouge, Suisse
contact@vellumpdf.ch
Under the revised Swiss FADP — and the GDPR when you are located in the European Union — you may request access to the data concerning you, its rectification, or its erasure, by writing to the email address above. We reply in writing.
Check it yourself, right now.
Open any tool, the Network tab alongside it, and watch the silence.