Security
How we protect your data
A short, honest overview. UCA PDF Editor is run by one developer (see the imprint). We hold no security certification (such as ISO 27001); this page says what we actually do.
Where data is stored
Our server is rented from IONOS SE and runs in an IONOS data centre in Kansas City, USA. Data on it is therefore processed outside the EU; the transfer is based on the EU Standard Contractual Clauses (SCC, Art. 46 (2) (c) GDPR) in our contract with IONOS. Your documents are not stored there: the apps edit, sign and scan on your device. Details: privacy policy.
Share links: encrypted end to end
When you share a file, the app encrypts it on your device (AES-256-GCM) before upload. The key is only in the link after the "#", which browsers never send to a server, so neither we nor IONOS can read the file or its name. Links expire after 1 to 30 days. The download page only hands out PDF files and warns that the sender is not verified. Anyone can report a link from its page; we review reports and remove illegal links.
Signatures: stored encrypted
Employees of a company draw their signature in the app. On the server it is stored encrypted (AES-256-GCM) and only delivered to that employee's own signed-in app and shown to the company's admins after approval. Nobody can upload a signature for someone else. On the device, saved signatures and stamps are encrypted with a key in the Android Keystore.
Sign-in by email code
There are no passwords. You sign in with a 6-digit code we email to you; it works for 15 minutes, is stored only as a hash and attempts are rate-limited (the limits survive server restarts). Sessions use secure, HTTP-only cookies; forms are protected against cross-site request forgery.
Transport and the website
All connections use TLS (HTTPS) with HSTS. The site sends a strict Content Security Policy (scripts only from our own domain), no tracking cookies and no third-party scripts. Server-to-server interfaces are reachable only inside the private network and need a token.
Report a vulnerability
Please write to noreply@ucagg.de (subject "Security"), in German or English. Give us a reasonable time to fix the issue before you publish it; we confirm receipt and keep you informed. Our security.txt has the same contact.
Subprocessors and other recipients
| Who | What for | Where / role |
|---|---|---|
| IONOS SE, Montabaur, Germany | Server hosting | Data centre Kansas City, USA; subprocessor, Standard Contractual Clauses |
| IONOS SE (mail servers) | Sending our emails (sign-in codes, invitations, receipts) | Subprocessor |
| Dodo Payments | Payments, invoices and VAT for company plans and Windows licences | Merchant of record; independent controller for the payment |
| Google (Google Play) | App distribution and the UCA PDF Plus subscription in the Android app | Independent controller for Play purchases |
| Google (AdMob) | Ads in the free Android app, only with your consent choice | Google Ireland Ltd.; data may go to the USA (Data Privacy Framework, SCC) |
Last updated: 23. Oktober 2026 / 23 October 2026