Last updated September 2026. Smallpdf publishes four security claims a business buyer can actually check: ISO/IEC 27001 certification, GDPR compliance, 256 bit TLS encryption in transit, and automatic deletion of uploaded files after one hour. The company is Swiss and has been trading since 2013. Nothing in its public record suggests a scam. The complaints that drive people to search whether it is legitimate are almost all billing complaints, and they trace to one specific mechanic: the free trial converts to a paid subscription automatically unless you cancel inside seven days.
That is the short version. Below is the longer one, aimed at somebody at a US firm who has to decide whether uploading a client's bank statement to a Swiss web service is acceptable, and what the paid plan is actually worth.
Is Smallpdf safe to use?
Smallpdf states that it is ISO/IEC 27001 certified and GDPR compliant, that files are encrypted in transit with 256 bit TLS, and that uploaded files are automatically deleted from its servers after one hour. Those are published, specific, falsifiable claims rather than vague reassurance, and ISO 27001 in particular is an audited certification. For ordinary business documents, that is a reasonable security posture.
The claims are worth reading precisely, because each one covers less than people assume. Here is what Smallpdf publishes and what it means in practice.
| Published claim | What it actually covers |
|---|---|
| ISO/IEC 27001 certified | An audited information security management system: documented policies, risk assessment, access control, incident response. It certifies how the company manages security, not that any individual product is bug free. |
| GDPR compliant | A European data protection regime. Useful signal of process maturity, but it is not SOC 2, not HIPAA, and not a US state privacy law. |
| 256 bit TLS in transit | Your upload cannot be read off the wire. It says nothing about who can read the file while it sits on the server during processing. |
| Files deleted after one hour | The strongest of the four for a finance team. A short, stated retention window is exactly what you want to be able to point at in a policy review. |
| Swiss company, operating since 2013 | Thirteen years of trading history and a jurisdiction with strong data protection law. Longevity is not a security control, but it is a real signal against fly by night risk. |
Is Smallpdf legit, or is it a scam?
Smallpdf is a legitimate company. It is registered in Switzerland, it has operated publicly since 2013, it states that 1.7 billion people have used it, and it publishes an audited security certification. The searches asking whether it is a scam are not about the software. They are about billing, and there is a documented reason for them.
Smallpdf's own trial signup copy says it plainly: by starting the trial you agree that Smallpdf will automatically continue your membership after the trial ends and charge your payment method until you cancel. Seven days is a short window. People start a trial to convert one document, forget, and see a charge. Smallpdf's own refund request form lists the reasons customers select, and the first two are "I forgot to cancel my subscription" and "I didn't sign up for Smallpdf." When a vendor builds those exact options into its refund form, it is telling you what its most common complaint is.
None of that is fraud. It is a standard auto renewing trial, disclosed at signup. But it is the single most useful thing to know before you click, so set a calendar reminder for day six if you only need one conversion.
What happens to your file after you convert it
Smallpdf's answer is that files are deleted from its servers one hour after processing. For a converter that is a good policy, and a short retention window is the specific thing an IT or compliance reviewer will ask about. Two caveats are worth carrying into that conversation.
First, a converted file has to be written somewhere to be converted at all, so "deleted after an hour" describes the retention policy, not an absence of processing. Second, if you create an account and use the cloud storage feature, you are choosing to keep files longer than an hour, which is a different arrangement from a one off anonymous conversion. If your policy is strict, do not sign in and do not store.
The trial and billing terms in one table
These figures come from Smallpdf's published US offer data and its own pricing FAQ, read in September 2026.
| Term | What Smallpdf publishes |
|---|---|
| Free trial length | 7 days |
| What happens at the end | Automatically continues as a paid membership and charges your card until you cancel |
| If you cancel during the trial | No charge, and the account downgrades to the free plan when the 7 days expire |
| Return window, United States | 7 days, published as a merchant return policy |
| Refunds after that | By request form rather than automatic |
| Payment methods | PayPal, Visa, Mastercard |
| Pro plan | $12.00 per month, or $108.00 per year |
| Team plan, 2 to 19 seats | $10.00 per seat per month, or $84.00 per seat per year |
The Team figure is the surprise in that table, and it runs opposite to how this category normally prices. Team costs less per person than Pro rather than more, so two people sharing a Team plan pay $168.00 a year against $216.00 for two individual Pro seats. The full plan by plan breakdown, including which features the free tier withholds, is on our Smallpdf PDF to Excel pricing and limits page.
What a US firm usually needs before uploading a client document
Security certifications answer the vendor's half of the question. The half that stops most accounting, legal and lending teams is their own: whether the engagement letter, the client agreement or the firm's own policy permits sending a document containing account numbers or personally identifiable information to any third party service. That answer is frequently no, and no amount of ISO 27001 changes it.
If you are the person who has to make that call, the practical checklist is short. Confirm whether the document contains regulated data at all, because a vendor invoice and a client's bank statement are not the same decision. Check whether your policy distinguishes between anonymous processing and an account with stored files. Read the retention window and write it down, because "deleted after one hour" is the sentence you will be quoting later. Ask whether the vendor will sign anything, since a consumer web tool generally will not negotiate a data processing agreement at $108 a year. And if your firm has to evidence any of this to a regulator or a client, you will need a way to map that obligation to a control you can actually show somebody, rather than a folder of screenshots.
For genuinely sensitive files, the honest options are a desktop tool that never transmits the document, or a vendor whose contract terms you can negotiate. A free web converter is the wrong shape for that requirement, however well run it is.
Where the real risk in a web converter usually is
In practice, the thing that goes wrong with a PDF to Excel conversion is almost never a breach. It is the numbers.
A converter can be perfectly secure and still hand back a spreadsheet where every amount is stored as text, so =SUM() returns zero. Accounting style negatives wrapped in parentheses come through as strings rather than negative values. Thousands separators survive into the cell and stop Excel treating the figure as a number. A table that spans a page break arrives as two disconnected blocks. Merged header cells shift a whole column one place to the right, which is the failure that actually costs money, because nothing looks broken.
That class of error is silent, which is what makes it dangerous. If you are converting a statement that will feed a reconciliation or a model, run a check before you build on the output: total a column and compare it with the printed total on the PDF, spot check the first and last row of every page, and confirm the row count. Our guide to checking a PDF to Excel conversion for errors walks through the specific checks, and cleaning up the data afterwards covers the fixes.
Is Smallpdf worth paying for?
It depends entirely on what you are buying it for, and the answer splits cleanly.
Pay for Smallpdf if you need a PDF suite. Thirty odd tools for $108.00 a year, covering merging, splitting, compression, editing, signing and redaction, plus a mobile app and bundled e-signature access, is good value against a single purpose tool, and considerably cheaper than a full Acrobat licence. If two to nineteen people need it, the Team tier at $84.00 per seat is better value again.
Do not pay for Smallpdf if conversion accuracy on financial tables is the entire job. A generalist suite is optimized for breadth, and dense statement layouts are a specialist problem. Two specific gaps matter for finance work: OCR for scanned pages is withheld from the free plan, so any scan requires a subscription, and Batch Convert is a paid feature, so a folder of documents cannot be processed for free at all. If your work is monthly statements, invoices and reports that need to land as clean numbers, a dedicated PDF to Excel converter is the better fit, and a converter that includes OCR without a tier upgrade removes the most common surprise.
The verdict
Smallpdf is safe enough for ordinary business documents and legitimate beyond reasonable doubt. Its security claims are specific and audited, its retention window is short and published, and its trading history is long. Buy it if you want a broad PDF toolkit, and buy the Team tier the moment a second person needs it, because it is cheaper per seat than Pro.
Two things to do before you click subscribe. Set a reminder to cancel on day six if the trial was only ever meant to cover one document. And check your own firm's policy on third party uploads first, because that is the constraint that actually decides this, not the vendor's certification. If you want the whole category priced side by side before committing to anyone, our PDF to Excel pricing comparison covers thirteen tools with US list prices, and the iLovePDF plan limits breakdown covers the other big free web converter.