PAPERGRID SECURITY MODEL · REVIEWED 16 SEPTEMBER 2026
Is an online PDF merger safe?
Safety depends on where processing happens, which network destinations the page can reach, the browser and device you trust, and what you do with the output. PaperGrid combines local PDF processing with an enforced same-origin browser policy, but it does not claim that a web page can eliminate every device or document risk.
For supported tools, selected file bytes are read by browser APIs and the output is created in memory on the device. PaperGrid pages also send security headers that restrict scripts, connections and resources, disable unnecessary browser capabilities and prevent the interface from being embedded in another site.
| Control | Enforced behavior | Boundary |
|---|---|---|
| Content Security Policy | Scripts and network connections are limited to the PaperGrid origin; object embeds and framing are blocked. | Does not control browser extensions, device agents or browser vulnerabilities. |
| Permissions Policy | Camera, microphone, location, payment, USB, serial and Bluetooth access are disabled. | Does not change permissions granted to unrelated websites or installed software. |
| No referrer | PaperGrid pages do not send their address as a referrer when following an external link. | The destination still receives a normal direct request from the browser. |
| Frame blocking | Other websites cannot embed PaperGrid's HTML interface in a frame. | This reduces clickjacking risk; it does not authenticate the person using the device. |
| HTTPS upgrade | Insecure subresource requests are upgraded to HTTPS. | HTTPS protects transport, not a compromised endpoint. |
VERIFY IT YOURSELF
Test with safe files before trusting a workflow
- Open Merge PDF in a current browser and use PaperGrid's generated sample files or two non-sensitive PDFs.
- In developer tools, inspect the Network panel while selecting and processing the files. Check that no request contains either document.
- Inspect the main HTML response under Network or Security and find the Content-Security-Policy and Permissions-Policy headers.
- After the offline cache is prepared, disconnect the network, reopen the merger and repeat the sample merge.
- Open the downloaded output, confirm its page count and content, and keep originals until the result has been reviewed.
What the policy restricts
- Third-party scripts and remote code
- Connections to non-PaperGrid origins
- Frames, plugins and object embeds
- Camera, microphone and location permissions
What remains outside it
- Browser extensions and managed-device software
- Malware or vulnerabilities on the device
- Authorization to handle a document
- Where a downloaded file is later uploaded or shared
Why same-origin is not “zero network”
The interface loads PaperGrid assets and records small same-origin action counters. The policy permits those same-origin requests. The privacy claim is narrower: selected document bytes, file names and tool values are not included in PaperGrid's processing or analytics requests.
SOURCE AND TESTING
Inspect the implementation and evidence
QUESTIONS & ANSWERS
PaperGrid security FAQ
Does a Content Security Policy prove that a PDF never leaves my device?
No. It is one enforceable browser control that restricts where the page may load code and make connections. PaperGrid also uses local file APIs, supports offline testing and publishes its processing boundaries, but no single control is a universal security proof.
Can PaperGrid send a selected PDF to another website?
PaperGrid's enforced policy limits page connections to its own origin, and supported PDF operations use the selected File objects locally. Browser extensions, managed-device software and browser vulnerabilities operate outside that page policy.
Does PaperGrid need camera, microphone or location access?
No. The site sends a Permissions Policy that disables camera, microphone, geolocation, payment, USB, serial and Bluetooth capabilities for PaperGrid pages.
How can I verify PaperGrid's PDF merger?
Use two non-sensitive files, inspect the Network and Security panels, confirm that document bytes are not posted, and repeat the merge after the offline application files have been cached and the network is disconnected.