HTML-to-PDF API with SOC2, GDPR, and HIPAA Compliance

HTML-to-PDF API with SOC2, GDPR & HIPAA Compliance

DocRaptor's HTML-to-PDF API processes many confidential documents, from financial reports to legal paperwork. We take security and privacy very seriously, both for our US-based customers and many international users. Strict adherence to compliance standards and third-party security audits provide independent verification of our commitment to keeping your PDF documents secure.

Infrastructure

DocRaptor uses Amazon Web Services (AWS) to host our infrastructure. Among their many industry-leading security practices, AWS data centers have biometric screening, intrusion detection, video monitoring, third-party audits, and 24/7 security operations centers.

Virtual access to our AWS infrastructure is restricted to required personnel and is available only through secure, multi-factor authentication.

Disclosure Policy

In addition to our third-party penetration testing, DocRaptor supports the work of security researchers to identify weaknesses in any technology.

Our Vulnerability Disclosure Policy outlines our guidelines for reporting potential vulnerabilities to our security team, and what aspects of our service are included and excluded for authorized research.

Processing Location & Infrastructure

Where is document content processed and stored?

DocRaptor renders documents on AWS in the us-east-1 region (US East, N. Virginia).

Is all processing performed in the United States?

Yes. Rendering runs on AWS us-east-1, so processing is performed in the United States.

Is DocRaptor self-certified under the US Data Privacy Framework (DPF)?

Yes. DocRaptor is self-certified under the DPF under the entity name "DocRaptor LLC." You can verify this at dataprivacyframework.gov/list by searching for "DocRaptor LLC."

Data Retention & Logging

What happens to documents after they're rendered?

Document data is briefly written to disk while processing. It is then stored encrypted in S3 until the account's configured Data Retention Period expires. Retention ranges from "as short as possible" up to 7 days. At the shortest setting, document input is deleted as soon as it's consumed, and the finished output is deleted as soon as it's downloaded (or after 15 minutes if it isn't downloaded). If a customer uses DocRaptor to host their documents, they remain encrypted until the expiration period they've set. Documents are always encrypted while stored on our servers.

Do application or infrastructure logs capture document content?

No. Logs contain metadata only (request IDs, sizes, timestamps), never document content.

What is the account setting for storing documents so support can help debug conversions, and how do I check or change it?

Retention is configurable per account, and data is automatically deleted once the configured retention period expires. See Document Storage: Privacy vs. Debugging Assistance for details.

The support-debugging share feature is available on all accounts but must be manually enabled per document. It isn't on by default. To share a specific document with our support team, go to Document Logs, click Details on the document, then click Request Help.

To disable this capability account-wide, enable HIPAA Mode, which also enforces minimal storage overall.

Are documents or their content ever used for anything besides fulfilling the render request, for example analytics or training a model?

We do not currently use document content for model training. Metadata may be used for service improvement and analytics. Accounts with HIPAA Mode enabled are excluded from this.

Sub-processors

Does DocRaptor publish a list of sub-processors?

Yes. The current list is published at docraptor.com/security-and-privacy/subprocessors.

Will we be notified if the sub-processor list changes?

Yes. Customers are notified by email when the list is updated.

Contracting Entity

Which entity is the contracting party and data processor?

DocRaptor, LLC, an Indiana limited liability company, is the contracting entity and data processor. Following Artifex Software, Inc.'s acquisition of DocRaptor, DocRaptor is now part of the Artifex Software group.