Smallpdf: where do your PDFs go?
Sovereignty score
57/100
High exposureSmallpdf is published by Smallpdf AG (Switzerland). The vendor falls under the US CLOUD Act: US authorities can request your files, whatever the hosting country.
Score calculated for this tool alone, without document-type weighting.
Checkpoints
- CLOUD Act
- Exposed Although the vendor is Swiss, relying on AWS infrastructure potentially exposes the hosting layer to extraterritorial requests.
- Jurisdiction
- Non-EU Switzerland — Swiss law (FADP) and GDPR, with a US cloud subprocessor (AWS)
- Servers
- Non-EU AWS infrastructure (notably European regions Ireland / Germany) and global CDN
- Retention
- Persistent Deleted within 1 hour for one-off processing; up to 14 days in backups after a cloud account is deleted
- AI
- No Confidentiality commitment with no declared reuse for model training.
Quick answers
Is Smallpdf subject to the CLOUD Act?
Yes. Although the vendor is Swiss, relying on AWS infrastructure potentially exposes the hosting layer to extraterritorial requests.
Where are files uploaded to Smallpdf hosted?
AWS infrastructure (notably European regions Ireland / Germany) and global CDN.
How long does Smallpdf keep your documents?
Deleted within 1 hour for one-off processing; up to 14 days in backups after a cloud account is deleted.
Does Smallpdf use your files to train AI?
Confidentiality commitment with no declared reuse for model training.
Which certifications does Smallpdf claim?
ISO/IEC 27001 · GDPR · nFADP (Switzerland)
Our analysis
Swiss vendor valued for its usability, but dependent on US hyperscalers and cloud storage once an account is enabled.
Source: Smallpdf Privacy Policy ·
Alternatives for “Conversion”
Tools with the same use, ranked by sovereignty score.
What about all your tools?
Get the sovereignty score of every PDF tool your teams use in 2 minutes. Free, no email, 100% local.