Answering Vendor Security Questionnaires About PDF Tools

Vendor security questionnaires assume a file upload. A browser tool that never receives the document has to say so in the form's own words, or the blank encryption answer gets scored as a miss. Question 47 on one review asked, "Describe encryption at rest for customer-uploaded documents." The accurate answer for a browser merge PDF tool was N/A, because nothing is uploaded. Procurement read that as a failure to understand the question and flagged the response yellow. The same gap shows up for compress PDF and split PDF when the file stays on the device. Translate the architecture into the control they asked about: where the bytes sit, how long anything is kept, and which vendors touch the site even when they never touch the PDF.

Common questionnaire sections

• Data classification handled
• Storage location and residency (EU, US)
• Encryption in transit and at rest
• Retention and deletion
• Access controls and MFA for admin
• Incident response and breach notification SLAs
• Subprocessors and fourth parties
• Pen testing and vulnerability management
• Compliance certs (SOC 2, ISO 27001)

PDF-specific add-ons:

• Malware scanning on uploads (if the tool uploads)
• JavaScript execution in the PDF engine
• Logging of document metadata

Browser-only processing answers

| Question | Sample honest answer | | --- | --- | | Where is data stored? | User device RAM during the session; not written to our databases | | Retention period? | Zero for file content; server logs 30 days | | Encryption at rest? | Not applicable to file content; TLS 1.2+ for site delivery | | DPA available? | Yes, with a subprocessor list |

Match the wording to GDPR browser processing and browser PDF privacy. Audits compare the written answers with the architecture.

Server-upload tools

If the tool uploads files, the form gets harder:

• State retention (for example, auto-delete after 1 hour)
• Encryption at rest (AES-256)
• Region pinning
• AV scan policy
• Whether humans can open files (the usual target is never)

Offline vs online PDF tools is the comparison customers can use when they are choosing a tier.

What procurement treats as a red flag

• A vague line such as "we take security seriously"
• No subprocessors listed while Google Analytics is running
• "Military encryption" with no algorithm or scope
• A free tool with no privacy policy
• Data sold to third parties

Phishing PDF attachments is a separate employee-training topic that often runs alongside tool approval.

Preparing a packet

Keep a security page and a one-page PDF:

1. Architecture diagram (browser vs server)
2. Subprocessor table with purposes
3. Certifications, or a roadmap if you do not have them yet
4. A security@ contact
5. Pen test summary date, if you have one

Update the packet when you add analytics or error tracking. Cookie notices covers the overlap with file-upload claims.

When the questionnaire is not enough

Confidential M&A documents are a case where the enterprise may still require desktop Adobe or an air-gapped tool, whatever the questionnaire says. The form does not override that data classification.

Employees using consumer tools

A workable IT policy splits the files:

• Public marketing PDFs: approved browser tools are fine
• PII, PHI, and financial documents: approved list only
• Unknown upload converters: not allowed

SIG Lite and the full SIG

Procurement may send an 800-question SIG. Plan on a security owner spending half a day on the first response, then keep the answers in a repository so the next form reuses them. Browser-only answers are shorter than the answers for a SaaS product that stores customer files.

Insurance and liability

Cyber insurance applications ask many of the same questions. Inconsistent answers between the insurance form and a customer SIG are what start underwriting disputes.

Sharing a pen test report

Share a redacted executive summary under NDA. Keep the full report, including exploit detail, restricted. Customers ask for the last pen test date. For enterprise sales, annual is the minimum cadence people expect.

Limitations

A privacy note can describe browser handling of the file. Enterprise procurement and security teams may still require a formal Data Processing Agreement (DPA), a SOC 2 or ISO 27001 report, or an offline desktop install for restricted data. In the questionnaire, separate the file-processing path (client-side WebAssembly or Canvas in memory, with no server retention of the file) from the website telemetry path (CDN logs, optional analytics, and contact forms). Reviewers check those controls separately.

What maps to a real design

Answer the question that was asked, in architectural terms. "No upload" is a valid encryption-at-rest answer when it is true. Keep the subprocessor list current, match the privacy policy, and describe browser processing in the vocabulary the form already uses.