Where does Smallpdf actually send your files?

Why we wrote this

Smallpdf gets a lot of trust from being Swiss — the logo, the address, the "Swiss-engineered" copy. People assume the files go to Switzerland and stay there. We wanted to find out if that's actually true.

This post sticks to what's verifiable from Smallpdf's own public docs. We don't have insider info and we're not accusing anyone of anything; we're just walking through what the documentation does and doesn't say.

What the front page suggests

The home page mentions "ISO/IEC 27001 certified" and the company being based in Zurich. The implicit story is: Swiss company, Swiss data, Swiss data protection. That's a strong default mental model.

What the privacy policy actually says

Reading the Smallpdf Privacy Policy (last verified by us in May 2026):

• Files are processed by Smallpdf AG (the Swiss entity)
• Hosting infrastructure is "leading cloud providers" — the policy doesn't enumerate them
• Processing may occur "in countries outside of Switzerland"
• Free tier files are retained for a period that "may differ" from paid

The phrase that does a lot of work there is "outside of Switzerland". That's compatible with Swiss data residency, EU data residency, or US data residency — the policy doesn't constrain which.

Their Data Processing Agreement (linked from the business plan page) does list sub-processors. Without sharing the full list (their docs change), we noted several US-based hyperscalers in the list at time of review. That's not unusual — most SaaS uses AWS or GCP — but it does mean some processing happens on US infrastructure.

Why this matters

Files on US-hosted infrastructure fall under the US Cloud Act, which allows US authorities to compel the provider to produce stored data regardless of where the data owner lives. ISO 27001 is about security controls, not jurisdiction.

For most people converting a PDF, this doesn't matter. If you're handling:

• Personal data of EU residents (GDPR)
• Healthcare data (HIPAA-adjacent obligations)
• Financial documents subject to local regulation
• Legal documents with privilege concerns

…then "the file may pass through US-hosted infrastructure" is a fact you'd want to know before clicking Upload.

How to actually verify the jurisdiction of any converter

Three checks: 1. Read the privacy policy for the words "data centers", "hosting", "sub-processors", and "international transfers". If those words avoid naming a region, the answer is usually "wherever cheapest". 2. Read the DPA (Data Processing Agreement) if they have one — sub-processor lists are usually published there. AWS regions, GCP regions, and Azure regions tell you the actual physical location. 3. Run a traceroute against the upload endpoint. The hops will reveal which cloud they're terminating on.

What bulkconvert does differently

Our path is short and specific:

• Files upload from your browser directly to CloudConvert's EU storage (Frankfurt) — they never touch our servers
• CloudConvert's EU region is the only region used for our pipeline
• The job result is held for 24 hours as a signed URL, then deleted by CloudConvert
• Our application servers (Vercel functions, Frankfurt) only handle metadata — never file bodies

We don't run our own ISO 27001 audit, and Smallpdf does. So if formal certification matters more to you than data path, Smallpdf has the stronger compliance posture. If physical EU residency matters more, bulkconvert has it.

Both are legitimate choices. The point of this post isn't "Smallpdf is bad" — it's "if you assumed Swiss-branded meant Swiss-only, the docs say otherwise."