Yes. PDFMonkey encrypts all data in transit over HTTPS (TLS) and at rest using encrypted database columns. Generated files are stored in private S3 buckets with presigned URLs that expire after one hour. All infrastructure is hosted on AWS in the EU (Paris) region.

Where is PDFMonkey data hosted?

All PDFMonkey infrastructure is hosted on Amazon Web Services (AWS) in the EU (Paris) region, including application servers, the database, and the S3 buckets that store generated files.

Does PDFMonkey share or analyze my data?

No. Your data is used exclusively to generate the requested document. It is never shared with partners, sold, or analyzed by PDFMonkey or any third-party service.

PDFMonkey Security: How Your Data Is Protected

PDFMonkey is designed to keep your data safe at every stage: when you send it, while it is stored, and when it is no longer needed. This page covers the specific measures in place to protect your Templates, Documents, and dynamic data.

Encryption in transit

All communication with PDFMonkey is encrypted over HTTPS (TLS). The API enforces SSL on every request; plain HTTP connections are automatically redirected to HTTPS.

This applies to:

API requests and responses
Dashboard and Builder sessions
Webhook deliveries to your server
Download URLs for generated files

Encryption at rest

The dynamic data you send to generate a Document (the payload and meta fields) is stored in an encrypted database column. It is decrypted on-the-fly only when needed for Document generation, and is never stored in plaintext.

Generated files (PDFs and images) are stored in private S3 buckets. Access is controlled through short-lived presigned URLs that expire after one hour.

Data isolation and access

PDFMonkey processes your data with strict boundaries:

Principle	Details
Purpose limitation	Your data is used exclusively to generate the requested Document. It is never shared with partners, sold, or used for analytics.
No third-party analysis	Your data is not analyzed by PDFMonkey or any external service.
Account isolation	Each account’s Templates, Documents, and generated files are isolated. You can only access resources that belong to your own Workspaces.
API authentication	Every API request requires a secret API key sent as a Bearer token. Keys are scoped to your account.

Keep your API key secret

Your API secret key carries the same privileges as your account. Never share it publicly or commit it to version control. If your key is compromised, regenerate it from the API Key page in the Dashboard.

European hosting

PDFMonkey infrastructure is hosted on Amazon Web Services (AWS) in the EU (Paris) region. This includes:

The application servers
The database (with encrypted columns)
The S3 buckets storing generated files and large payloads

Data deletion

Your data is removed when you no longer need it:

Manual deletion: deleting a Document through the Dashboard or API permanently removes its payload, metadata, and generated file.
Automatic deletion (TTL): each Template has a configurable retention period. When a Document’s TTL expires, it is automatically deleted. See Retention and Automatic Deletion for details.
Account deletion: deleting your account permanently removes all Workspaces, Templates, Documents, and generated files. See Account Deletion.

Temporary HTML pages generated during the rendering process are discarded immediately after generation.

Webhook security

When PDFMonkey sends webhook notifications to your server, the payload is delivered over HTTPS. You can verify the authenticity of webhook deliveries using signature verification. See Webhooks for the full setup guide.

API Authentication – how API requests are authenticated
Data Storage and Retention – what data PDFMonkey stores and for how long
Retention and Automatic Deletion – TTL-based document cleanup
Compliance and DPA – GDPR alignment, data processing agreements, and sub-processor list
Webhooks – webhook setup and signature verification

Frequently asked questions

Is PDFMonkey secure?: Yes. PDFMonkey encrypts all data in transit over HTTPS (TLS) and at rest using encrypted database columns. Generated files are stored in private S3 buckets with presigned URLs that expire after one hour. All infrastructure is hosted on AWS in the EU (Paris) region.
Where is PDFMonkey data hosted?: All PDFMonkey infrastructure is hosted on Amazon Web Services (AWS) in the EU (Paris) region, including application servers, the database, and the S3 buckets that store generated files.
Does PDFMonkey share or analyze my data?: No. Your data is used exclusively to generate the requested document. It is never shared with partners, sold, or analyzed by PDFMonkey or any third-party service.