Compliance checklist for legal teams handling PDFs

Legal operations teams routinely evaluate document-processing tools. The evaluation criteria are similar across firms: privacy, security, audit, contractual, and operational fitness. Here is the checklist we get sent, with our answers.

Privacy

1. Where does the vendor process personal data? Answer: for our conversion tools, in the user's browser only.
2. Which sub-processors are used? Answer: none for conversion; nctools Cloud for account management.
3. What is the retention period? Answer: zero, for files; account data retained for the life of the workspace plus 90 days.
4. Is there a Data Processing Agreement? Answer: yes, standard EU DPA available on request.

Security

1. How are TLS certificates managed? Answer: TLS 1.3, managed by our hosting provider, rotated quarterly.
2. Is the platform SOC 2 audited? Answer: type II in progress; type I completed Q4 2025.
3. Are dependencies scanned for vulnerabilities? Answer: yes, on every commit via Dependabot and Snyk.
4. How are credentials stored? Answer: bcrypt hashes; no plaintext, no reversible encoding.

Audit

1. Can we see who ran which conversion, when? Answer: on Team and Enterprise plans, yes — the per-user activity log records tool name, page count, timestamp. It does not record the file itself.
2. Are logs immutable? Answer: yes, appended-only in nctools Cloud with per-workspace encryption.
3. How long are logs retained? Answer: 12 months by default, configurable up to 7 years on Enterprise.

Contractual

1. What is the SLA? Answer: 99.9 percent for the auth and dashboard; conversion tools are client-side and inherit the user's device availability.
2. Where is the governing law? Answer: Slovak law, with an English-language contract available.
3. What happens on termination? Answer: 30-day export window, then full deletion.

Operational fitness

A checklist without operational fitness is theory. Ask any tool for a 15-minute pilot with your team's real files. If the pilot is a smooth experience, if the outputs are usable, if support answers in hours not days — that is the last thing to verify.