Client-side PDF tooling means the bytes of a user's document are transformed in the browser runtime instead of being POSTed to your API for Ghostscript to chew on. I wish more README "quick tips" sections said that in one sentence before linking a random upload merge site.
Mental model
file input → ArrayBuffer/Uint8Array → pdf-lib / WASM → Blob → download
No multipart/form-data of the PDF to your merge endpoint. You may still serve app.js and module.wasm from a CDN. Asset delivery ≠ document upload. If your privacy copy blurs those, rewrite the privacy copy.
When someone says "but it's an online tool," answer with the diagram. Online delivery of code is not online custody of documents.
A story from a code review
We almost shipped an internal "helper" that proxied merges through a free SaaS because it was one fetch call. Security asked where passport scans from onboarding would land. Silence. We ripped the helper out and pointed the wiki at a browser-local flow instead. Same user outcome. Entirely different custody story. The PR description still makes me wince — "temporary convenience" is how retention bugs start.
Why product folks should care
Less PII on your disks. Simpler privacy notices. Fewer "please delete my file" tickets. Aligns with "we minimize data" claims when those claims are true. Shrinks breach blast radius because the sensitive bytes were never yours to lose. Support stops mediating between a panicked user and a deletion SLA you don't control.
Trade-offs without the brochure tone
Pros: custody stays with the user; scales with their CPU; solid for merge/split/rotate/basic compress; compliance storytelling that survives a Network-panel demo.
Cons: huge files stress mobile memory; advanced OCR, malware scanning, or fleet-wide batch jobs may still need servers you control with contracts and auditing.
Client-side isn't a personality. It's the right default when the device can finish the job. Pretending mobile Safari can crush a 400-page image archive overnight is how you get angry tickets. Pretending every three-page NDA needs your S3 bucket is how you get angry lawyers.
What to tell users (be boring and precise)
Say: "Your PDF is processed in your browser and isn't uploaded for this action." Don't hide behind "bank-level encryption" with no architecture behind it. If you add an optional server feature later, gate it with explicit UI — never silently upload after teaching users you're local.
Reference UX helps when writing docs. I point people at tools like pdfmergefiles.com so they can feel the workflow we want them to expect from privacy-respecting utilities.
How to verify any tool (including yours)
Open DevTools → Network. Run a merge. You should not see the PDF body uploaded. If you do, the marketing page lied. Apply the same test in QA before launch. I keep a checklist in PRs:
- Network panel clean of PDF POSTs during merge
- No analytics packing file names or contents
- Clear UI copy about local processing
- Workers + progress for large jobs
- Memory-conscious behavior on mid-range phones
- HTTPS and a serious origin security posture
- Optional server paths clearly labeled and opt-in
Where server-side still wins
Use your own hardened pipeline for central malware scanning of inbound attachments, cross-user OCR search indexes, or overnight batch over millions of pages. That's intentional architecture with logging and retention. It is not a reason to tell users to visit a random upload merge site for prep. "We have servers for malware scanning" and "please upload your NDA to this ad-funded freebie" are not the same sentence.
Documentation snippet you can paste
Prepare PDFs on your device. Prefer browser-local merge/split/compress so document bytes aren't uploaded for those actions. Then submit through this product's official upload, which is covered by our DPA.
That separates user prep from your regulated intake path a distinction auditors and juniors both understand. Link your approved local example in the wiki; don't make people invent one under deadline pressure.
Privacy note for builders
If you never took custody, you don't have to pretend you deleted custody. Prefer client-side whenever the user's device can finish the job. Draw the diagram once. The rest of the conversation gets shorter.
Top comments (0)