Security and compliance

EU processing with storage you control

We process documents in the EU. Keep them in managed storage with configurable retention, send them to your own bucket, or use stateless mode to process them in memory without persistence.

GDPR compliant
Hosted in the EU
Stateless option

Storage and security options

Choose where files go and how long they remain available.

EU

Hosted in Germany

We process all data in Frankfurt, Germany. Our infrastructure stays within the European Union and complies with GDPR requirements.

  • EU-based infrastructure (Frankfurt)
  • GDPR-compliant processing
  • No data transfers outside EU
  • German data protection standards
Secure

Flexible storage

Choose managed storage with configurable retention, your own bucket, or stateless processing that keeps documents in memory only.

  • Managed storage with configurable retention
  • Stateless mode via storage: "memory" parameter
  • No content persisted in stateless mode
  • Full control over your data lifecycle
BYOB

Bring your own bucket

Send generated PDFs directly to your AWS S3 bucket, where you control the documents and access policies. Support for more providers is planned.

  • Direct upload to your AWS S3 bucket
  • Your encryption, your keys
  • Full access control
  • GCP, MinIO & more coming soon
Private

Control your data

REST requests default to stateless, in-memory processing, while MCP requests default to managed storage. Set the storage mode per request when you need BYOB or a different retention policy.

  • Document content excluded from usage logs
  • Stateless mode via storage: "memory"
  • Managed storage with retention policies
  • Usage and error metadata retained

Technical details

Processing, retention, encryption, and logging at a glance.

Data processing
Processing location Frankfurt, Germany (EU)
Data storage Managed, BYOB, or stateless mode
Retention period Configurable (stateless mode available)
Encryption TLS 1.3 in transit
Compliance standards
GDPR Compliant
Data residency EU only
Access logs Usage metrics only
Audit trail API calls logged (no content)

Bring your own bucket

With BYOB, generated PDFs go directly to your AWS S3 bucket. Your encryption keys, access policies, and compliance controls apply, and we do not retain the files after generation.

AWS S3 Google Cloud Storage (soon) MinIO (soon) More providers coming
BYOB configuration
{
  "storage": "byob",
  "bucket": "your-bucket-name",
  "region": "eu-central-1",
  "path": "generated-pdfs/"
}

Security questions

Details about processing, retention, BYOB, and GDPR.

Where is my data processed?

All data processing occurs exclusively in our Frankfurt, Germany infrastructure. Your HTML content and generated PDFs never leave the European Union.

Is my document content stored?

The default depends on how you connect. REST requests process PDFs in memory without persisting them. MCP requests use managed storage with configurable retention. You can override either default per request or use Bring Your Own Bucket to store PDFs in your own AWS S3 bucket. Support for more providers is planned.

How does BYOB work?

With Bring Your Own Bucket, you provide your AWS S3 bucket credentials. Generated PDFs are uploaded directly to your storage, bypassing our infrastructure entirely for file storage. Support for GCP, MinIO, and other S3-compatible providers is coming soon.

What data do you retain?

Usage logs contain API call timestamps, credit consumption, error details, and request metadata, but not document content. In memory mode, generated files are not persisted. Managed storage keeps the PDF and, where available, searchable text until the configured retention period ends.

Is the service GDPR compliant?

Yes. Our infrastructure stays within the EU, and the storage model is GDPR compliant. For zero-retention requirements, select stateless mode in the request. We can provide a Data Processing Agreement (DPA) upon request.

Can I get a DPA?

Yes. Enterprise customers can request a Data Processing Agreement. Contact us at support@pdf-mcp.io for more information.

Have a compliance question?

Contact us about enterprise compliance requirements, DPA requests, or security questionnaires.

Connect to pdf-mcp

Use the hosted MCP endpoint over Streamable HTTP. There is no package or local server to install.