Short answer: PDF Candy is a legitimate, GDPR-compliant service with solid baseline security — encrypted transfers, AES-256 encryption at rest, and a 2-hour auto-deletion window you can also trigger manually. For everyday documents, that’s reasonable. Worth reading the fine print on one specific claim, though: PDF Candy advertises "ISO 27001-certified infrastructure," which refers to the cloud data centers they rent space from, not necessarily an ISO certification audited for PDF Candy’s own organization specifically. That’s a meaningful distinction if you’re comparing it against a competitor with its own direct certification. Either way, the bigger structural point is the same as every cloud PDF tool: your file has to travel to a server before anything happens to it.
Here’s what happens to a file on PDF Candy, what its security claims actually cover, and where a browser-based tool skips the trip entirely.
What happens when you upload a file to PDF Candy
The standard cloud sequence:
- Your file travels to PDF Candy’s servers over an HTTPS/TLS connection.
- It’s encrypted with AES-256 while stored and processed.
- The processed file comes back to you for download.
- The original is deleted from their servers — automatically within 2 hours, or immediately if you request early removal.
PDF Candy notes its servers are located in both the EU and the US, which is a slightly different setup than competitors that keep everything strictly inside EU borders. That’s not automatically a problem, but it is a detail worth knowing if you’re specifically trying to keep a document’s processing within one jurisdiction.
PDF Candy’s actual security standing
- HTTPS/TLS encryption in transit, AES-256 encryption at rest during processing and storage
- GDPR compliance stated in their privacy policy and security page
- 2-hour automatic deletion window, with a manual "delete now" option
- Data centers in the EU and US
- No public record of a major breach
The one claim worth reading carefully: PDF Candy’s security page states it "operates on ISO 27001-certified infrastructure from leading cloud providers." That means the underlying data centers carry the certification — a common and legitimate setup — but it’s a different claim than a company holding its own ISO 27001 certification for its specific information security management practices, the way some larger PDF competitors do. Neither is inherently more or less secure, but they’re not interchangeable claims, and it’s easy to skim past the difference.
The free tier’s real limit: one task per hour
Independent of the privacy question, PDF Candy’s free web tier caps you at one task per hour across the whole platform. For a single compression job that’s a non-issue; if you’re working through a stack of documents for exam paperwork or a multi-step conversion, you’ll hit that wall fast and be pushed toward a paid Web or Desktop plan.
Where the upload itself is the problem
A 2-hour window, even a well-encrypted one, still means the file existed somewhere outside your device for a while. For a few document categories, that’s the actual risk, not the encryption strength.
Photos and signatures for government exam forms. UPSC, SSC, RRB, PAN, NEET, TNPSC applications need photos and signatures compressed to precise KB targets. Since these carry your face and signature, using local resizers like the UPSC Image Resizer, SSC Photo Resizer, or our general Signature Resizer ensures they never leave your device. These carry your face and signature tied to an identity process — a task simple enough that it doesn’t need a server, US-based or otherwise.
Aadhaar and other ID documents. e-Aadhaar PDFs are password-protected specifically to control who can open them. Uploading one to decrypt and compress it — even for two hours, even encrypted — adds risk. Using our local Aadhaar PDF Compressor skips the server step entirely.
Contracts, medical records, and financial paperwork. PDF Candy’s terms explicitly disclaim liability for files uploaded to the site and don’t offer a Business Associate Agreement for HIPAA purposes — worth knowing before trusting it with anything covered by a confidentiality obligation.
The alternative: tools that never leave your device
This is exactly the problem ZapToolHub is built around. Every tool — image compression, resize, PDF compression, and Aadhaar-specific tools — runs entirely in your browser using WebAssembly. There’s no server, US or EU, in the loop at all — and no hourly task cap either, since nothing is being metered on a backend.
You can check this yourself: load any tool, let it finish loading, then switch off your WiFi. It keeps working, because there was never anything to upload. Try that on PDF Candy’s web tools and it stops the moment your connection drops.
The honest trade-off: a low-memory phone will feel a very large file more than a desktop would, since your device does the processing instead of a server. For the everyday case this site is built for — an SSC photo down to 20KB, a UPSC signature resize, an Aadhaar PDF under a size cap — that’s rarely a real constraint, and there’s no per-hour limit to work around either.
When PDF Candy’s model is genuinely a fine choice
For non-sensitive documents and occasional use, PDF Candy is a competent, encrypted, GDPR-compliant option with a fair retention window. If you need heavier batch processing regularly, their paid Desktop app does move processing to your own machine — similar to what several competitors offer as a local alternative — just at the cost of a subscription or lifetime license.
A simple rule of thumb
If a document carries your photo, signature, ID number, or anything you wouldn’t want briefly sitting on a server in another country, default to a tool that processes it locally for free — not as a paid upgrade. Save cloud tools for the documents you genuinely don’t mind, or for situations where their extra features (bulk batch processing, for instance) are worth the trade-off.
Frequently asked questions
Where does PDF Candy store my files? On servers located in both the EU and the US, encrypted with AES-256, for up to 2 hours unless you delete manually sooner.
Is PDF Candy’s ISO 27001 claim the same as being ISO certified themselves? Not exactly. PDF Candy states it runs on "ISO 27001-certified infrastructure from leading cloud providers," meaning the data centers are certified — a different claim from PDF Candy holding its own organizational ISO 27001 certification, which some competitors do have.
Does the free version of PDF Candy have limits? Yes — the free web tier is capped at one task per hour across the platform. Removing that cap requires a paid Web or Desktop plan.
Is it safe to compress an Aadhaar PDF or exam photo on PDF Candy? Their encryption and 2-hour deletion window are solid for routine use, but the file still has to be uploaded to be processed. A browser-based tool like our Aadhaar PDF Compressor that compresses the file locally skips the upload entirely, which is a cleaner fit for an ID document.
What’s the safest free way to compress a photo or signature for a government exam application? Use a tool where compression happens directly in your browser with no hourly limit and no upload — such as our UPSC Resizer, SSC Photo Resizer, or general Signature Resizer — so that the file never leaves your device and you’re not rationed to one task an hour.