Is Docqify HIPAA compliant?

That question has no yes-or-no answer for any software, because HIPAA compliance is a property of a covered entity’s practices rather than a certificate a tool holds. What can be said precisely is that Docqify does not create, receive, maintain or transmit your files, so the business associate relationship that would normally need papering does not arise. Your privacy officer is the right person to decide whether that satisfies your obligations.

Can I use this on a work computer where uploads are blocked?

Usually, and for the reason the block exists — there is no upload for the policy to catch. If your organisation filters by category rather than behaviour it may still be blocked, in which case the Content-Security-Policy header is the specific thing to show whoever maintains the list.

What happens to my document when I close the tab?

It is gone from the page. Work in progress is held in your browser’s own storage so a refresh does not lose it, and clearing site data removes that. The original file was only ever on your disk, where you put it.

Do you log anything at all?

The site uses privacy-preserving page analytics served from our own domain, recording which pages were viewed. No file, no filename, no page content and nothing about the document you are working on is included, because none of that ever reaches a server that could record it.

Is there a limit on file size?

No imposed limit, but a real practical one: the document is held in your device’s memory while it is worked on. A large scanned bundle behaves well on a workstation and can exhaust an older phone. That is the honest cost of doing the work locally.

How do I know a future version will not start uploading?

You do not have to take it on faith. The Content-Security-Policy is served on every response, so a change would be visible immediately in your own developer tools, and the offline test would begin to fail. That is a weaker guarantee than a contract and a much easier one to check, because it does not depend on anyone honouring anything.

Guide

PDF tools for confidential workwhere the file never leaves your device

Written for the person who has to approve this. What the software does, what it does not do, and how to verify both without taking our word for any of it.

27 August 20267 min read

Docqify processes documents in your browser and transmits nothing, which removes the transfer that most confidentiality rules are written about. That is not a certification, and this page is equally clear about what you are not getting.

The question this page exists to answer

Somebody in a law firm, a clinic, an HR department or a finance team needs to merge two contracts or black out an account number, reaches for the first PDF site in the search results, and stops — because the document in front of them is one they are not allowed to hand to a third party.

That instinct is correct, and the usual reassurances are unsatisfying. "We delete files after two hours" is a promise about what happens after the transfer, not a reason the transfer was acceptable. "Enterprise-grade security" is not a claim about anything in particular.

The answer here is structural instead: there is no transfer. What follows is what that means, stated precisely enough that whoever signs off can check it rather than trust it.

What a normal online PDF tool does with the file

Not as an accusation — the mainstream services are run responsibly and publish what they do. iLovePDF states that files are deleted within two hours of being processed on their servers. Smallpdf encrypts transfers with TLS, deletes signed-in users’ files within an hour unless they are saved, and publishes that processing happens on servers in the United States or Europe.

Those are reasonable policies. They are also, every one of them, descriptions of a document that has left your building. The file was transmitted, held on infrastructure you do not control, in a jurisdiction you did not choose, and its deletion is something you are told about rather than something you can observe.

For most documents that is a sensible trade. For a privileged communication, a patient record or an unredacted personnel file, it is the specific event your obligations are written about.

What happens here instead

Docqify is a web page that does its work in the browser tab already running it. When you open a PDF, your browser reads it from your disk. The merging, compression, redaction, signing and text extraction happen in that tab using your own processor, and the result is written back to your downloads folder. There is no copy anywhere else, because there is no server to put one on.

That is a strong claim, so here is what backs it. The site ships a Content-Security-Policy that the browser enforces — an HTTP header, not a policy document. Its connect-src directive permits connections only to this origin and to blob: and data: URLs, all of which are local to the tab. form-action is set to none, so the page cannot even submit a form somewhere else.

The practical consequence is that a bug, a compromised dependency, or a bad decision on our part could not send your document anywhere without first changing this header — which is visible in your own developer tools, on every request.

default-src 'self'
connect-src 'self' blob: data:
img-src 'self' blob: data:
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'
worker-src 'self' blob:
form-action 'none'

The six directives that matter here, quoted verbatim from the sixteen in the Content-Security-Policy served on every docqify.app response

What that changes for the rules you work under

Docqify holds no certifications, and none of what follows is legal advice. What this section can do is state what the software does precisely enough that the person who does make the call is working from facts rather than marketing.

HIPAA: the business associate rules attach to a vendor that creates, receives, maintains or transmits protected health information on a covered entity’s behalf. Docqify does none of those, so there is no vendor in the transaction to paper an agreement with — much as opening a file in a locally installed editor does not create one. Whether that reasoning covers your circumstances is your privacy officer’s determination.

GDPR: we do not receive the document, so we are not a processor of the personal data inside it. There is no sub-processor to disclose, no international transfer to justify, and no retention period to state, because there is no copy whose retention could be measured.

Legal privilege: routing a privileged document through a third party invites an argument about who else held it and on what terms. Not routing it through anyone does not.

Corporate DLP: many organisations block file-upload sites outright. Docqify is usually not caught by those rules for the same reason they exist — it does not upload — and the header above is the artefact to send to whoever maintains the list, because they can verify it in a browser rather than accepting a vendor questionnaire.

How your security team can check this in ten minutes

None of this requires trusting the page you are reading. Three checks, in increasing order of how conclusive they are.

Read the header. Open developer tools, reload docqify.app, select the document request, and read the Content-Security-Policy in the response. It is the one printed above.

Watch the network while working. Keep the Network tab open and run a document through any tool. No request carries the file, because the policy above forbids one from existing.

Take the network away entirely. Load the site once, then disconnect and keep using it. Every tool continues to work, which is only possible if the processing was never remote. This is the check worth doing, because it cannot be faked by a page that is merely being careful about when it uploads.

What this does not give you

A page that listed only advantages would deserve the scepticism it got, so here is the other column.

There is no Business Associate Agreement, no SOC 2 report and no ISO 27001 certificate, because there is no service relationship to audit. If your process requires a signed agreement with every vendor that touches sensitive material, Docqify will not satisfy it — though it is worth asking your reviewer whether a tool that receives nothing is a vendor in the sense the policy means.

There is no audit log, no administrative console, no per-user access control, and no way to enforce anything across a team. If you need to prove who redacted what and when, this does not produce that record.

There is no support agreement, no uptime commitment and no contractual liability. It is a free tool.

And the risk has moved rather than vanished. Your device is now the sensitive place: a shared workstation, an unlocked browser profile, a downloads folder syncing somewhere else, or a machine with malware on it are all failure modes that client-side processing does nothing about. Working locally narrows the problem to your own environment. It does not remove it.