Is iLovePDF safe? And Smallpdf? What happens to your files
Checked against our tools on 18 October 2026
For everyday documents, yes. Both upload your file to their servers, encrypt it on the way, and delete it automatically: iLovePDF within two hours of processing, Smallpdf after one hour, according to their own help pages as we read them on 18 October 2026. Both say they're ISO/IEC 27001 certified and GDPR compliant. The better question is whether a particular document should leave your device at all. For a passport scan, medical records or a contract under NDA, a tool that runs in your browser takes the question off the table.
Go straight to the tool: Merge PDF, Split PDF, Sign PDF
Is iLovePDF safe?
For everyday documents, yes. It uploads your file, but it states plainly how long it keeps it and lets you delete it sooner. Here's what it says it does:
- Files are processed on iLovePDF's servers and deleted automatically and permanently within two hours of processing.
- The download screen has a Delete it now button to remove them sooner.
- Its e-signature tool is the exception to the two-hour rule, because signed documents need to be kept.
- It says it complies with ISO/IEC 27001 and the GDPR, and that files are encrypted in transit.
Is Smallpdf safe?
For everyday documents, yes, on the same terms. It deletes ordinary uploads faster than iLovePDF, but keeps some files longer if you share or store them. Here's what it says it does:
- Files are processed on Smallpdf's servers and deleted permanently after one hour.
- Files you share by link or send for e-signature are kept for 14 days.
- Files saved to an account's document storage stay until you delete them, and are removed from its servers within an hour after that. Storage can be turned off.
- It says it is ISO/IEC 27001 certified and complies with the GDPR.
Side by side
As stated by each service on 18 October 2026. Policies change, so check the source pages listed at the end before relying on a detail.
| iLovePDF | Smallpdf | ConvertFile | |
|---|---|---|---|
| Where files are processed | Its servers | Its servers | In your browser for 60 of 64 tools; on our server for the rest |
| Automatic deletion | Within 2 hours | After 1 hour | About 60 minutes, for the server tools |
| Delete sooner yourself | Yes | Yes | Yes |
| Kept longer | E-signature documents | Shared links and e-signature (14 days); saved documents | Nothing |
| ISO/IEC 27001 | Says it complies | Says it is certified | No certification |
What "safe" can and can't mean here
A deletion policy is a promise. Neither you nor we can see inside another company's servers, so "deleted after an hour" means you're trusting the company to do what it says. Both of these companies have been around for years and publish their policies plainly, which counts for something.
An ISO/IEC 27001 certificate means an auditor checked that the company runs a documented security programme. It's a good sign about how seriously they take security. It doesn't mean nobody there can ever see a file, and it can't make an upload riskless.
In fairness to both: they offer things a browser-only tool can't, such as e-signature workflows with audit trails, team accounts and cloud storage. Those features need your file on their servers. If you use them, the retention rules above are the ones that matter.
The most common real risk isn't either company. It's copycat sites with similar names that host ads and do who knows what with uploads. Check the address bar is ilovepdf.com or smallpdf.com before you add anything.
How to check whether any PDF tool uploads your file
You don't have to take anyone's word for it, ours included.
- Open the tool's page, then open your browser's developer tools (F12 on Windows, Cmd+Option+I on a Mac) and choose the Network tab.
- Add your file and run the tool.
- Look for a request whose size is close to your file's size. If there's one, the file was uploaded. If the only traffic is small, the work happened on your device.
A quicker test
Load the tool, run it once on a harmless file, then turn off Wi-Fi and run it again on the real one. A tool that runs in your browser keeps working offline; one that uploads will fail. The first run matters because some browser tools download extra code the first time they're used, such as our HEIC decoder and OCR engine.
When to keep a file on your device
- Identity documents: passports, driving licences, visa paperwork.
- Medical, financial and tax records.
- Anything covered by an NDA, or by an employer or client rule against third-party uploads.
- Anything you'd be uncomfortable explaining if it leaked.
Where ConvertFile fits
Most of our tools never upload anything: merging, splitting, signing, protecting, unlocking, redacting, OCR and the PDF to Word, JPG and PNG converters all run in your browser. Three tools do upload, because they need server software: Compress PDF, Repair PDF and Office to PDF conversion. Those files are encrypted in transit and deleted about 60 minutes after processing, or sooner if you choose. Each tool page says which kind it is, right under its name.
We're a small, new service and we don't hold an ISO/IEC 27001 certificate. For the in-browser tools that doesn't matter, because we never receive the file. For the three server tools, it's a fair reason to weigh us the same way you'd weigh anyone else.
Sources
iLovePDF: ilovepdf.com/help/security and ilovepdf.com/blog/delete-file-from-ilovepdf. Smallpdf: smallpdf.com/blog/is-smallpdf-safe and smallpdf.com/blog/how-to-turn-off-document-storage-with-smallpdf. All read on 18 October 2026.