GDPR-compliant PDF generation: what to ask a PDF API vendor

Invoices, payslips, contracts and medical letters go through PDF APIs, and each of them is personal data under the GDPR. Before you send them to a vendor, you need answers to a short list of questions. Here they are, with what a good answer looks like and where to find ours.

1. Is the document stored, and for how long?

Many APIs keep the output for a while so you can download it from a link. That’s convenient, and it means the vendor holds copies of every document. Ask whether storage is on by default, whether you can turn it off, and how long files and request logs are kept.

Ours: documents are rendered in memory and never stored, and there is no option to store them. Request metadata (key id, time, endpoint, status, size, duration) is kept 30 days. See privacy & security.

2. Where is it processed, and by whom?

Ask for the list of sub-processors with their locations, not just “we use AWS”. Check which of them see document content, and whether any transfer leaves the EU/EEA, and under which safeguard.

Ours: one server at Hetzner Online GmbH in Helsinki, Finland; the full list is on /trust, and only Hetzner ever handles document content, in memory.

3. Is there a data processing agreement?

Article 28 requires one when a vendor processes personal data for you. Ask whether it’s available without a sales call, whether it lists the technical measures and sub-processors, and what the breach-notice period is.

Ours: the DPA is on the site and applies automatically; breach notice within 48 hours.

4. What ends up in logs and error trackers?

This is where documents leak by accident: a request body in a debug log, or an error tracker that captures the payload. Ask what fields are logged, whether bodies can be logged, and which error-tracking service sees requests.

Ours: the only logger accepts a fixed list of metadata fields; no access log, no IP addresses, no error tracker sees request data.

5. Can you check any of this?

Most of these answers are promises. Ask what you can verify yourself: response headers, signed records, published keys.

Ours: every response carries a signed receipt for the exact bytes, which you can check at /verify or offline. It shows what was produced, when and where, and that the API didn’t store it. It can’t prove deletion; nothing can from the outside.

6. Is user-controlled HTML safe to send?

If your users influence the HTML or URL, a renderer can be pointed at internal addresses. Ask how the vendor blocks private and metadata addresses, for the page and every resource it loads.

7. Who is the contracting party?

Know who you sign with, where they are, and which law applies. Ours is in the legal notice and the terms.

A one-page summary of our answers, for whoever signs off on vendors, is on GDPR and EU hosting. This guide is general information, not legal advice.