Merge PDFs privacy model

This tool is classified as core workload and runs in On-device mode. Current status: ga (fully-functional).

What this does

• Applies the selected transformation to the document or exported output.
• Keeps processing local in browser when marked On-device.
• Uses monthly local counters for usage quotas.

What this does not protect

• It does not remove names or sensitive content visible in document text or images.
• It does not guarantee legal anonymity or endpoint compromise protection.
• For hybrid tools, privacy depends on explicit cloud opt-in when enabled.
• Merge does not normalize legal redactions or review comments automatically.
• Encrypted or malformed inputs may fail and require cleanup first.

Safe workflow defaults

• Verify output manually before sharing.
• Use security guidance at /security for higher-risk scenarios.
• Keep original and transformed files separated to avoid accidental leaks.