Security
Last updated 28 October 2026.
InHousePDF is a static site. PDF work runs in a Web Worker in your browser. The Content Security Policy allows connections only to this site (connect-src 'self') while advertising is off. Forms are not posted to another origin. Tool pages do not load third-party scripts.
What to expect in the network log
Loading the site fetches HTML, CSS and scripts from inhousepdf.com. Building a pack after that should add no further requests. The proof panel on the builder records requests that start while a pack is assembled. File bytes are not placed in a request body.
Self-hosting
IT teams can host the static files themselves. The nginx image serves only those files and is not configured to call out. Ads and analytics are disabled in that build. See the README section on internal hosting. A licence fee is not on sale yet.
Reporting a problem
Email the address below to report a vulnerability. Please do not send sample PDFs that contain personal data.
A machine-readable file is at /.well-known/security.txt.