The PDF Merge engine is a browser application. Every operation — merging, sorting, rotating, splitting, rendering previews and exporting the result — runs in the visitor's browser.
What never happens
- No upload. Your documents are never sent to RSJ, to the iframe host or to any other server.
- No storage. We do not keep documents, page images or extracted text, so there is nothing to delete or to breach.
- No server-side processing. The server only delivers the application files.
What the server sees
The hosting server sees what any web server sees for the request that loads the application: IP address, time, the requested file, the referring page and the browser string. These requests contain no document data.
The iframe boundary
The editor runs in an iframe on your page. The browser enforces the origin
boundary; the SDK and the editor exchange messages only between the two origins.
The SDK compares event.origin with the embedUrl origin and ignores
everything else, so no third party can drive your editor instance.
Google Drive
“Add from Google Drive” and “Save to Google Drive” talk to Google directly from
the browser, with an OAuth token the user grants to your OAuth client. File
contents are downloaded by the browser and never pass through RSJ. The editor
asks for the narrow drive.file scope, so it only sees files the user picks.
Self-hosted deployments
In a self-hosted setup the application is served from your own infrastructure and the offline licence makes no network calls. The document handling is identical — everything stays in the browser — so an air-gapped deployment has no data to protect beyond the client machine itself.
Analytics
The embedded editor needs no analytics cookies to work. In a hosted deployment analytics is optional and feature-level only: no document content, no file names, no page text.
Questions
For security questionnaires, architecture reviews or a data processing agreement, contact info@rsj.de.