Acceptable Use Policy

This policy is part of our Terms of Service and uses the terms defined there. It applies to every request made with an API key issued to you. You are responsible for making sure that anyone who uses the Service through your account or your application follows it.

Illegal and harmful content

Do not send content to the Service, or use the Service to produce or store content, that:

• Is child sexual abuse material. We do not tolerate it. When we learn of apparent child sexual abuse material, we report it to the police and to the National Center for Missing and Exploited Children (NCMEC), keep it only as the law requires, and close the account.
• Infringes intellectual property rights, such as copyright or trademark. Copyright complaints follow our Copyright policy.
• Was collected or is processed in breach of privacy or data protection law.
• Is meant to deceive, such as forged invoices, identity documents, certificates or signatures.
• Breaks any other law that applies to you or to us.

Do not use the Service to remove protection from documents you are not authorized to open or change, or to remove watermarks, notices or other marks that you do not have the right to remove.

Malicious files and attacks

• Do not upload malware, or files built to exploit the conversion engines, to escape their isolation, or to exhaust their resources, such as decompression bombs, oversized images or deeply nested documents. The Service checks image dimensions before decoding, caps the decompressed size of PDF streams and the unpacked size and number of entries in ZIP files, and runs conversions with internet access turned off. These controls do not make such uploads acceptable.
• Do not probe, scan or test the Service for vulnerabilities, except as allowed by our vulnerability disclosure policy. Research that follows that policy is welcome.
• Do not try to reach parts of the Service that are not documented for customers, such as the conversion containers or our storage, and do not try to guess or enumerate download links for files that are not yours.
• Do not use the Service to attack, scan or send traffic to other systems. HTML pages are rendered without network access, so requests from an uploaded page to other addresses are refused.
• Do not run load tests or send traffic designed to degrade the Service for other customers without our written agreement.

Data we do not support

Do not send the following to the Service:

• Protected health information under HIPAA. We are not a business associate under HIPAA and we do not sign business associate agreements.
• Payment card data covered by the PCI Data Security Standard, such as full card numbers, security codes or magnetic stripe data.
• Export-controlled technical data under the International Traffic in Arms Regulations or the Export Administration Regulations.
• Personal information about children collected in breach of the Children's Online Privacy Protection Act.
• Special categories of personal data under the GDPR, such as health, biometric or genetic data, and data about criminal convictions, unless we have agreed to it in writing, as our Data Processing Addendum says.
• Sensitive personal information under US state privacy laws, such as government ID numbers or precise location, unless you have given the notices and obtained the consents those laws require to have us process it for you.

If you are not sure whether your data falls into one of these groups, email legal@pdfconversionapi.com before you send it.

Using the Service fairly

• Stay within the limits. Do not get around rate limits, size limits or other technical limits, for example by spreading requests across several keys or accounts. The current limits include your plan's monthly conversions, conversions at once and upload size (100 MB at most, all files and fields together), 120 seconds of processing per conversion, and 600 requests per minute per account. The limits page lists them all.
• One account per organization. Do not open more than one account, for example by signing up with different email addresses, to get around limits, unless we agree in writing.
• Keep keys to yourself. Do not share API keys outside your organization, sell them, or publish them.
• No reselling the raw API. You may build products and services that use the Service. You may not offer the Service itself to others as a general-purpose file conversion API, for example by passing our endpoints through under your own name with no product of your own around them, without our written agreement.

High-risk uses

Do not use the Service where a failed conversion or a difference between a converted file and its original could lead to death, personal injury, or serious physical or environmental damage. Examples include operating medical devices, emergency services, aircraft, nuclear facilities or weapons systems. Our Terms of Service explain that converted files may not reproduce every element of the original.

Sanctions

Do not use the Service if you are named on a US government list of restricted parties, or from a country or region subject to comprehensive US sanctions. These are currently Cuba, Iran, North Korea, and the Crimea, so-called Donetsk People's Republic and so-called Luhansk People's Republic regions of Ukraine. Section 14 of the Terms of Service has the full rule.

How we enforce this policy

• We do not routinely monitor or scan the contents of files. We act on reports we receive and on what our systems record, such as request volumes, error rates and response codes.
• Depending on how serious a violation is, we may contact you and ask you to stop, rate-limit or disable specific API keys, delete stored files, suspend your access, or close your account. Where the law requires it, we report the activity to the authorities or to NCMEC.
• For child sexual abuse material, attacks on the Service or other systems, and sanctions violations, we may close an account immediately and without warning.
• We will tell you which rule we believe was broken and what we did, unless the law prevents us or telling you would undermine an investigation.
• If you think we made a mistake, reply to our notice or email abuse@pdfconversionapi.com, and a person will review the decision.

Reporting abuse

Email abuse@pdfconversionapi.com and include:

• the download link, or the request ID from the x-request-id response header, if you have one;
• what you saw and when; and
• how we can reach you.

If you are reporting child sexual abuse material, do not send us the material itself, not even as an attachment. Send the link or request ID only. You can also report it directly to NCMEC's CyberTipline.

Copyright complaints go to copyright@pdfconversionapi.com under our Copyright policy. Security vulnerabilities go to security@pdfconversionapi.com under our vulnerability disclosure policy.