PDFMonkey GDPR Compliance and Data Processing Agreement (DPA)
Last updated October 6, 2026
PDFMonkey aligns its data handling practices with GDPR requirements. This page covers the company’s compliance posture, the available legal agreements, and the key privacy commitments built into the platform.
Compliance posture #
PDFMonkey does not hold a formal compliance certification (such as SOC 2 or ISO 27001). As a small, focused company, pursuing these certifications is not currently feasible. Instead, PDFMonkey implements concrete security measures that protect your data at every stage: encryption in transit and at rest, EU-only hosting, strict access controls, and configurable data retention.
No certification does not mean no security
GDPR data roles #
When you use PDFMonkey, the GDPR roles are defined as follows:
| Role | Party | Responsibility |
|---|---|---|
| Data Controller | You (the User) | You determine what personal data is sent to PDFMonkey and for what purpose. |
| Data Processor | PDFMonkey | PDFMonkey processes your data exclusively to generate the Documents you request, following your instructions. |
PDFMonkey processes your data only for the purpose of providing the service. It is never analyzed, shared with partners, sold, or used for any other purpose.
If you are yourself a Processor acting on behalf of a Controller (for example, generating documents for your own clients), PDFMonkey provides a separate Data SubProcessing Agreement (DsPA) that formalizes the Controller-Processor-SubProcessor chain.
Data Processing Agreement (DPA) #
PDFMonkey provides two standard agreements covering data processing obligations under GDPR:
| Document | Use case | Link |
|---|---|---|
| Data Processing Agreement (DPA) | You are the Controller; PDFMonkey is your Processor | Download DPA (PDF) |
| Data SubProcessing Agreement (DsPA) | You are a Processor; PDFMonkey is a SubProcessor acting on your Controller’s behalf | Download DsPA (PDF) |
Both agreements took effect on October 1, 2026, replacing the versions dated March 1, 2023. They cover:
- Definitions aligned with GDPR terminology
- Data processing obligations and instructions
- Security measures and confidentiality
- Audit rights (once per year, 30 days’ notice)
- Breach notification procedures
- International data transfer safeguards
- Approved sub-processor list
- Data deletion on termination
Need a custom agreement?
Key GDPR commitments #
The following commitments are formalized in the DPA and reflected in PDFMonkey’s technical implementation:
EU data hosting #
PDFMonkey’s core infrastructure is hosted in the European Union:
- Application servers and background workers run on Fly.io in Paris, France.
- File storage (S3) and the rendering engines run on Amazon Web Services in Paris, France.
- The database runs on Neon in Frankfurt, Germany.
Your data does not leave the EEA unless a sub-processor requires it, in which case the transfer is protected by GDPR-compliant safeguards (adequacy decisions or standard contractual clauses). See Security Measures: European hosting for details.
Purpose limitation #
PDFMonkey processes your data exclusively to generate the Documents you request. It is never shared beyond the sub-processors listed below, never used for profiling or analytics, and never used to train AI models.
Data minimization and retention #
You control how long your data is stored. Each Template has a configurable TTL (Time To Live) that automatically deletes Documents after the retention period expires. You can also delete Documents manually at any time. See Data Storage and Retention for the full picture of what is stored and when it is removed.
Breach notification #
If PDFMonkey becomes aware of a personal data breach affecting your data, it notifies you without undue delay. The notification includes the nature and scope of the breach, a point of contact, likely consequences, and remediation measures taken or proposed.
Data deletion on termination #
When you delete your account, PDFMonkey ceases all processing and permanently destroys all your data, including Templates, Documents, generated files, and dynamic data.
Approved sub-processors #
PDFMonkey uses a limited set of sub-processors. The DPA requires PDFMonkey to notify you in writing at least 30 days before adding or replacing a sub-processor, giving you time to object.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | File storage and document rendering | France |
| Fly.io | Application servers and background workers | France |
| Neon | Database | Germany |
| Heroku | Job queue and real-time messaging (Redis) | Ireland |
| Memcached Cloud | Application cache | European Union |
| Cloudflare | DNS, TLS termination and network protection | Global |
| Svix | Webhook delivery | European Union |
| Sentry | Error monitoring of the rendering engines | Germany |
| Rollbar | Error monitoring of the application | United States |
| Scout APM | Application performance monitoring | United States |
| SendGrid | Transactional email delivery | United States |
| Anthropic | AI template generation (prompts only) | United States |
| ServaRica | PDF watermarking server | Canada |
For the legal entity and privacy terms of each sub-processor, see Section 5 of the DPA or DsPA.
Frequently asked questions #
Does PDFMonkey have SOC 2 or ISO 27001 certification?
No. PDFMonkey is a small company and does not currently hold formal compliance certifications. The Security Measures page describes the technical and organizational measures in place.
Can I audit PDFMonkey?
Yes. The DPA grants you the right to audit PDFMonkey’s data processing practices once per year, during business hours, with at least 30 days’ written notice. Audit costs are borne by you unless the audit reveals non-compliance on PDFMonkey’s part.
What happens to my data if I cancel my subscription?
When you delete your account, PDFMonkey permanently deletes all your Workspaces, Templates, Documents, and generated files. See Account Deletion for the full process.
Is my data transferred outside the EU?
PDFMonkey’s servers, database and file storage are in the EEA. Some sub-processors, such as error monitoring, email delivery and AI template generation, are located outside the EEA. These transfers rely on adequacy decisions, including the EU–US Data Privacy Framework, or on standard contractual clauses.
Related pages #
- Security Measures – encryption, access controls, and data isolation
- Data Storage and Retention – what data PDFMonkey stores and for how long
- Document Retention and Automatic Deletion – TTL configuration and plan-based limits
- Account Deletion – what happens when you delete your account
- Support – how to reach the PDFMonkey team
Frequently asked questions
- Is PDFMonkey GDPR compliant?
- PDFMonkey follows GDPR principles: its servers, database and file storage are located in the EU, data is encrypted in transit and at rest, never shared beyond the listed sub-processors, and deleted when no longer needed. PDFMonkey acts as a data Processor on your behalf.
- Does PDFMonkey provide a Data Processing Agreement (DPA)?
- Yes. PDFMonkey provides a standard DPA and a Data SubProcessing Agreement (DsPA), both available for download. If your organization requires a custom data privacy agreement, you can contact PDFMonkey to arrange review and signing.
- Where is PDFMonkey data hosted?
- PDFMonkey's application servers run on Fly.io and its file storage and rendering engines on AWS, both in Paris, France. The database runs on Neon in Frankfurt, Germany. A few supporting services, such as error monitoring and email delivery, are provided by sub-processors outside the EEA under GDPR safeguards.
- What sub-processors does PDFMonkey use?
- PDFMonkey uses a limited set of sub-processors: AWS, Fly.io and Neon (hosting, storage and database), Heroku and Memcached Cloud (queue and cache), Cloudflare (DNS and network), Svix (webhooks), Sentry, Rollbar and Scout APM (monitoring), SendGrid (email), Anthropic (AI template generation) and ServaRica (PDF watermarking). The full list is detailed in Section 5 of the DPA.