Security
In short
On LUNYCE, your files are not uploaded. They are processed by your browser, on your device. So there is nothing to intercept during an upload, no document stored on a server, and no account to hack.
What happens when you use a tool
- The page and the tool engine are loaded from lunyce.com, like any web page.
- Your file is read in your browser's memory. It goes nowhere.
- The result is created on your device, then you download it.
- When you close the page, everything disappears. One exception: with "Continue with…", the file is kept for a few moments in your browser to open it in the next tool, then deleted.
The difference with sites that upload your files
Most online PDF services process documents on their servers: the file is uploaded, kept while it is processed, then deleted after a delay. With LUNYCE, that step does not exist: your payslips, ID documents, contracts and bank statements stay with you.
Technical protections
- Encrypted connection: the site is only available over HTTPS (HSTS enabled).
- Strict security policy (CSP): the browser forbids the page from sending data anywhere other than lunyce.com. One exception: Cloudflare's cookie-free audience measurement, which counts visits and never receives your files.
- No third-party code for the tools: every library (PDF.js, pdf-lib, Tesseract, qpdf…) is hosted on lunyce.com, with no external service.
- Protection against malicious embedding: the site cannot be displayed inside another site's page (protection against "clickjacking").
- No account, no advertising cookie: there is no database of accounts or documents to steal.
- Transparency: on the HEIC pages, the security policy is slightly relaxed, because the iPhone photo decoder has to compile code when it loads. Traffic is still limited to lunyce.com.
Check it yourself
Open your browser's developer tools (F12 key), "Network" tab, then process a file: no request sends your document. You will only see the site's own files loading.
Good habits for sensitive documents
- Add a watermark to a copy of an ID document before sending it.
- Redact information that is none of the recipient's business (account number, address, salary).
- Erase a PDF's metadata and the location of your photos.
- Protect a PDF with a password (AES 256-bit encryption) before emailing it.
Report a vulnerability
Found a security issue? Write to contact@lunyce.com. The contact details are also published in the standard security.txt file.