Security

legivel runs in Falkenstein, Germany, with a European hosting provider. Every document is converted there, in memory, and the PDF is returned in the same response, or sent to the storage address you give. We generate the PDF in memory and don't store the documents you convert, the data that fills a template, or the PDFs. Templates you save, with their sample records, are stored encrypted until you delete them.

Connections to legivel use TLS. We keep encrypted backups every night and monitor the service publicly at status.legivel.com. Enterprise agreements state the availability we commit to.

For each conversion we keep sizes, page counts, timings, a result code and opaque ids (for connected apps, the app's identifier), so we can count your documents and answer a support question. Never the text, never the PDF.

A retry with the same idempotency key is recognized by a hash of the key and a hash of the document; the document itself is rendered again, not read back.

Images loaded from the web for a document are held in memory for that conversion only. We keep a fetch id, the account and counts for 90 days, never the addresses. How we load images describes the fetcher and how a site can block it.

Our request records hold, for each call, the time, route, status, timing, sizes, an error code and opaque ids (for connected apps, the app's identifier). They hold no IP address and no document content, and are kept for 90 days. A sign-in session records the address and browser it was opened from, so that a session can be recognized and revoked; that record lives as long as the session, and sessions expire after 30 days without use.

We keep no web-server access log of our own; Cloudflare keeps edge logs on its side. Logs never contain document content, certificate material or API keys. Logs leave the server over an encrypted connection to our monitoring.

If you upload a certificate for sealing, the bundle and its password are encrypted at rest with a key kept apart from the database. The certificate's subject and expiry date are stored in clear so your account page can show them. You can delete a stored certificate at any time; deletion is immediate.

A certificate sent inline with a request is used for that request and not saved. Each sealed PDF is recorded by the certificate's fingerprint and a fingerprint of the finished file, never by its content.

A template you save is stored encrypted, with its images, sample records and editing history, until you delete it. Deleting it takes effect at once.

Hetzner runs the hardware, in Germany. Cloudflare terminates connections in front of it. Resend sends our account emails; Google Workspace carries our support and business mail. If you sign in with Google or GitHub, they learn that you signed in to legivel. Paddle, our merchant of record, handles payments; it sees your billing details and never your documents. Google Analytics 4 counts site visits only after you accept it; Cookiebot by Usercentrics records that consent choice. Better Stack runs our status page and monitoring, under opaque identifiers. The sub-processors page is the authoritative list; where the two differ, it wins.

Encrypted database backups are kept for 30 days on storage in Helsinki, Finland. They hold account data, usage records and saved templates, encrypted, never the documents you convert.

When you delete your account, on your account page or by email, the account, its sessions with their address records, keys, saved templates and stored certificates go at once. Usage records stay for 13 months under an identifier no longer linked to you; invoices are kept for the period the law requires. Deleted data, and values we clear on a schedule, can stay in an encrypted backup for up to 30 days, until that backup expires. The Privacy page has the detail.

Write to security@legivel.com. Describe what you found and how to reproduce it; do not include customer data. We answer within two working days and tell you what we do about it. Please give us time to fix before you publish.