Is Foxit Safe in 2026? A Detailed Privacy Review

Q: How long does Foxit keep my files?

It depends entirely on which Foxit product you use: Foxit PDF Editor desktop in off-grid mode: files are never uploaded — they stay on your computer Foxit Cloud (optional sync/collaboration): retained per your account configuration until you delete Foxit AI Assistant: document text sent to Microsoft Azure AI is retained by Azure for up to 48 hours before purging Foxit eSign: signed documents are retained per legal requirements for audit trail purposes My Account web data: account information is retained per Foxit's privacy policy With a browser-based tool like HonestPDF, no upload occurs at all on any tool, so retention does not apply.

Short answer: Foxit is a legitimate, enterprise-grade PDF company founded in 2001 and headquartered in Fremont, California, serving over 700 million users worldwide with strong compliance credentials: SOC 2 Type II, ISO 27001, GDPR, HIPAA (with Business Associate Agreement available), CCPA, FedRAMP-aligned controls, and eIDAS compliance. Foxit PDF Editor runs primarily as desktop software — when used in "off-grid" mode with cloud services disabled, files stay entirely on your computer. That is a genuinely private workflow. However, Foxit also operates My Account and cloud services that do collect user data, and the company was breached in 2019, exposing 328,549 account records including email addresses, passwords, names, phone numbers, company names, and IP addresses. For the core desktop editing workflow on a paid license, Foxit is among the most enterprise-credentialed options available. For users on the free cloud tier, mobile apps, or eSign services — the data exposure profile is different and worth understanding before committing to confidential documents.

This article walks through how Foxit actually handles your data in 2026, the 2019 breach and what it revealed, the difference between Foxit's desktop and cloud products, and the alternative architecture for users who prefer processing files with no upload at all.

What Foxit actually is (and isn't)

Unlike Smallpdf, iLovePDF, PDF24, or PDFCandy, Foxit is primarily desktop and enterprise software, not a free web PDF toolkit. The product lineup in 2026 is:

Foxit PDF Reader — free lightweight desktop PDF viewer (Windows, macOS, iOS, Android)
Foxit PDF Editor — paid desktop application ($10.99-$14.99/month) for creating, editing, signing, OCR, redaction, form filling (Windows, macOS, iOS, Android)
Foxit PDF Editor+ — $172.79/year with eSign, Smart Redact, full mobile apps, 150 GB cloud storage
Foxit eSign — standalone electronic signature service (cloud-based)
Foxit Admin Console — centralized license and policy management for enterprises
Foxit Cloud Services — document sync, collaboration, AI features (optional add-ons)
Foxit PDF SDK — developer libraries for embedding PDF features in other apps

For a Foxit PDF Editor desktop user with cloud services disabled ("off-grid" mode), no files are uploaded to Foxit servers for processing. Editing happens entirely on your local machine. This is meaningfully different from Smallpdf or iLovePDF, which are cloud-first by design.

For users of Foxit's cloud services, AI Assistant, eSign, mobile apps, or My Account web features, the data flows are more cloud-dependent and involve third parties like Microsoft Azure AI (for AI Assistant) and various analytics providers.

Where Foxit is actually headquartered

Foxit has historically been the subject of online speculation about Chinese ownership, because the company had early roots and continues to have engineering operations in Fuzhou, China. The official position in 2026 is:

Headquarters: Fremont, California, USA (founded 2001)
European headquarters: Dublin, Ireland (GDPR and EU operations)
Engineering offices: Fuzhou, China (software development)
Additional offices: Australia, Germany, Japan, and other markets

Foxit operates as a US-headquartered global company. Regulatory filings, compliance certifications, enterprise contracts, and data protection officer designations all trace back to Foxit Software Inc. in California and Foxit Software (Europe) in Dublin. For US federal customers and regulated industries, Foxit holds certifications that require US-based accountable entities.

That said, for buyers with specific supply-chain concerns about engineering operations in China (e.g., certain US defense or intelligence contexts), the engineering geography is worth knowing. For most commercial and consumer users, this is not a practical concern.

Foxit's security and compliance posture

Foxit's published security position in 2026 is among the strongest in the PDF category — genuinely on par with Adobe Acrobat for enterprise compliance:

SOC 2 Type II attestation for security, availability, confidentiality, and privacy trust services criteria
ISO/IEC 27001 certified for information security management
GDPR compliant with designated data protection officer and Dublin-based EU operations
HIPAA compliant with Business Associate Agreement available for qualifying healthcare customers
CCPA and CPRA compliant for California residents
TAA (Trade Agreements Act) compliant for US federal procurement eligibility
eIDAS supported for qualified electronic signatures when used with qualified trust service providers
FDA 21 CFR Part 11 alignment for life sciences electronic records and signatures (eSign API supports compliant flows)
AES 256-bit encryption for data in transit and at rest across cloud services
Secure software development lifecycle with code review, vulnerability scanning, and penetration testing
"Off-grid" enterprise mode where Foxit PDF Editor operates with no cloud access at all, for organizations with high-security requirements
JavaScript execution can be disabled per user or organization-wide via Group Policy for defense against PDF-embedded JavaScript attacks
Cross-domain resource access disabled by default in both Reader and Editor
Active Directory integration and SCCM/SCUP support for enterprise deployment and patching

For procurement reviews in regulated industries — healthcare, finance, legal, government — Foxit clears the standard compliance checklist. It is arguably the most enterprise-ready PDF software outside of Adobe Acrobat.

The 2019 My Account breach — what actually happened

The most significant item in Foxit's public security record is a data breach disclosed in August/September 2019:

Unknown third parties gained unauthorized access to Foxit's My Account systems
328,549 user account records were exposed
Exposed data included: email addresses, passwords, user names, phone numbers, company names, IP addresses
Not exposed: payment card details, because Foxit's system does not store credit card data (payments are handled by external processors)
Response: Foxit invalidated all affected passwords, forced resets, notified law enforcement and data protection authorities (including under GDPR via the Dublin office), hired a security management firm for forensic analysis, and contacted affected users directly

My Account is Foxit's free membership service for downloading trial software, accessing order histories, product registration, and support information. The breach affected the web account system, not the PDF documents that users process through Foxit PDF Editor on their own computers.

What the breach did NOT expose:

Document content processed locally in Foxit PDF Editor
Files stored on users' own computers
Enterprise deployments in off-grid mode

What the breach raised concerns about:

Whether Foxit's hashing/salting of passwords was adequate (the disclosure did not specify the algorithm used, which security researchers criticized at the time)
Whether some older password policies (6-20 character range with basic requirements) aligned with current NIST guidance (they did not — NIST updated guidance to recommend 8-64 characters without forced composition rules)
General concerns about the security posture of the account-management infrastructure

Foxit's response to the breach was relatively transparent by industry standards — public disclosure, regulator notification, affected-user communication, and a commitment to hiring external security consultants. In the years since, Foxit has significantly expanded its compliance certifications (SOC 2 Type II, ISO 27001, HIPAA BAA availability) which suggests real investment in post-breach security maturation.

For anyone who had a Foxit My Account before 2019 and has reused the same email/password combination elsewhere, it is worth rotating that password even now. For users of the core desktop Editor without a cloud account tied to it, the breach did not affect document content.

Where the cloud parts of Foxit become the risk

Foxit PDF Editor used purely as desktop software is not a cloud privacy issue — the files stay on your computer. But several Foxit products and features do route data through servers:

Foxit Cloud (document sync and collaboration)

Files synced to Foxit Cloud for sharing, collaboration, or cross-device access are stored on Foxit infrastructure. These services are covered by Foxit's privacy policy, SOC 2, and ISO 27001 — but the structural fact is that the document leaves your device. For confidential documents, routing them through Foxit Cloud is the same category of decision as using Smallpdf: third-party server exposure, regardless of certification.

Foxit AI Assistant (Azure AI Language)

Foxit's AI features for summarization, rewriting, translation, and Q&A use Microsoft Azure AI Language as a backend. According to Foxit's privacy policy, text data sent to AI features may be temporarily stored by Azure AI Language for up to 48 hours before being purged. This means that when you use Foxit's AI Assistant on a document:

The document text is sent to Microsoft Azure
Azure processes it to produce a summary, rewrite, or answer
The text may be retained by Azure for up to 48 hours
The document is then purged from Azure's systems

For a casual use case, this is a reasonable trade-off. For confidential legal briefs, medical records, financial statements, or source code — sending the text to Microsoft Azure for 48-hour retention is a meaningful data-flow that your compliance team should know about. This is not specific to Foxit (Adobe's AI Assistant uses a similar model); it is a property of cloud AI in general.

Foxit eSign

Electronic signatures require audit trail and signed-document retention for legal validity, especially for eIDAS-aligned flows. Signed documents in Foxit eSign are retained per legal requirements, similar to DocuSign or Adobe Sign. This is appropriate for the product category but means those specific documents are not "off-grid."

Foxit mobile apps

The free mobile Reader apps and the PDF Editor+ mobile apps communicate with Foxit services for cross-device sync, license validation, and optional cloud features. While documents opened locally on mobile are processed locally, integrated features (AI, sync, eSign) route data to Foxit infrastructure.

My Account, website analytics, marketing

The foxit.com website uses Google Analytics, HubSpot, VWO (A/B testing), and standard marketing tools. These do not see document content but do collect standard web analytics and marketing interaction data — appropriate disclosure is in Foxit's privacy policy.

"Off-grid" mode — the genuinely private Foxit workflow

Foxit's differentiator versus most PDF vendors is a formally supported "off-grid" operational mode:

Foxit offers users and organizations the option to operate the software in complete "off-grid" mode, where no cloud service access will be performed by the software installed by users. This capability offers additional deployment and operational flexibility for organizations with high level of security needs.

In practice, this means:

Foxit PDF Editor installed as a licensed desktop application
Cloud services disabled via preferences or Group Policy in enterprise deployments
JavaScript execution disabled for PDF documents (defense against malicious PDFs)
Cross-domain resource access disabled
AI Assistant disabled (it requires Azure calls)
eSign disabled (it requires cloud)
Document sync disabled

In this configuration, Foxit PDF Editor is a local PDF application. No document content leaves your computer during normal editing, redaction, form filling, or signing workflows. This is a genuinely private workflow and is why Foxit is widely deployed in regulated environments — banks, law firms, healthcare systems, government agencies.

The catch: off-grid mode requires a paid Foxit PDF Editor license ($10.99-$14.99/month minimum) and some configuration. It is not the default experience for a user downloading Foxit PDF Editor for the first time — cloud features are enabled out of the box. Users who expect "local = private" need to actively configure the software that way.

Where Foxit costs matter

Independent of privacy, Foxit's practical characteristics in 2026:

Not free for full editing — Reader is free, but Editor starts at $10.99/month or $129.99/year
Enterprise licensing requires sales contact for volume deals, Admin Console, and custom deployments
AI Assistant is a $49.99/year add-on with 2,000 credits/month (Azure-backed)
Perpetual licenses exist (~$159-$210 one-time) but with restrictions — desktop-only, no mobile, no automatic updates to future major versions
Mobile apps require PDF Editor+ subscription ($13.99/month or $172.79/year) for full editing
Learning curve — the ribbon-style interface is familiar to Microsoft Office users but can feel dense for casual users
Enterprise support is strong; consumer/individual support receives more mixed reviews

For an individual or small team processing 10+ PDFs per week, Foxit is cost-competitive with Adobe Acrobat and significantly cheaper. For occasional PDF work, Foxit's pricing may be overkill.

How browser-based PDF tools change the model

There is a fundamentally different architecture that has matured significantly since 2023: PDF processing that runs entirely inside your browser using WebAssembly. No upload, no server-side processing, no retention window to worry about, because the document never leaves your device in the first place. This works on every operating system that runs a modern browser — Windows, macOS, Linux, ChromeOS, iOS, and Android — without installing any software or managing licenses.

This is the architecture HonestPDF uses. When you merge, redact, sign, compress, or convert a PDF, all of the processing happens in your browser using the same compute resources that render the page you are reading. There is no upload endpoint for tool files, no account system to breach (like Foxit's 2019 My Account incident), and no cloud AI service retaining your document text for 48 hours.

The trade-offs are honest. Foxit PDF Editor with off-grid mode has capabilities browser-based tools do not yet match — enterprise OCR accuracy on degraded scans, AI-powered Smart Redact with PII detection, eIDAS-aligned qualified electronic signatures with QTSP integration, MCP Host workflows for enterprise automation, comprehensive form design, and deep Windows/Microsoft integration. For an enterprise compliance officer doing heavy PDF work with a licensed desktop application configured correctly, Foxit is a legitimate secure choice.

For everyday privacy-sensitive work — redaction, merging, simple signing, compression, conversion, basic OCR — the browser-based model removes categories of risk that even a well-configured enterprise tool creates.

Side by side: when each approach makes sense

Foxit is a reasonable choice when:

You are a professional or enterprise user willing to pay $11+/month for full PDF editing
You will configure off-grid mode correctly and disable cloud services for sensitive work
You need enterprise compliance certifications (SOC 2 Type II, ISO 27001, HIPAA BAA) on your procurement checklist
You need eIDAS-compliant qualified electronic signatures for legally binding documents
You need deep Windows/Active Directory/SCCM integration for enterprise deployment
You are replacing Adobe Acrobat and want comparable features at lower cost

A browser-based tool like HonestPDF is the safer choice when:

The document is confidential, legally privileged, or regulated — and you want "no upload" as a structural guarantee, not a configuration choice
You are on macOS, Linux, iOS, Android, or ChromeOS and don't want to install and license desktop software
You don't want to pay a subscription for occasional PDF work
You don't want to manage accounts that could be breached (the 2019 My Account incident is a real example)
You want a default-private experience without configuration
You simply prefer the documents you process to never leave your device, regardless of server certifications or off-grid toggles

Neither approach is universally correct. Foxit PDF Editor with off-grid mode is a genuinely strong enterprise privacy posture when correctly configured. The questions are whether you will actually configure it correctly, whether you need the paid enterprise feature depth, and whether you want "private" to be a default or a setting.

A practical workflow recommendation

For most professionals, the cleanest workflow in 2026 looks like this: use a browser-based tool by default for quick privacy-sensitive tasks (redaction, merging, signing, form filling) because it is instantly private on any device with no configuration. Reserve Foxit PDF Editor for power-user workflows where you genuinely need advanced features — enterprise OCR, Smart Redact with AI, eIDAS qualified signatures, heavy form design — and run it in off-grid mode with cloud services disabled for sensitive documents.

This gives you two tools for two job sizes: a frictionless private default for the majority of PDF work, and a paid enterprise application for the minority of tasks that genuinely need it.

Frequently asked questions

Is Foxit safe to use?

Foxit PDF Reader and Foxit PDF Editor are legitimate, widely-used software from a US-headquartered company with strong enterprise compliance credentials (SOC 2 Type II, ISO 27001, GDPR, HIPAA BAA available). The core desktop applications are used by 700 million people globally including banks, law firms, and government agencies. The main public security incident is the 2019 My Account breach affecting 328,549 web-account records — which affected the account system, not document content processed on users' computers. For desktop PDF editing with cloud services disabled, Foxit is among the most compliance-credentialed options available.

Is Foxit owned by China?

No. Foxit is headquartered in Fremont, California, USA, founded in 2001, with European operations in Dublin, Ireland. Foxit does operate engineering offices in Fuzhou, China, which is the source of recurring online speculation about Chinese ownership — but the company itself is US-registered, US-headquartered, and holds compliance certifications (including TAA for US federal procurement) that require US accountability. For buyers with specific supply-chain requirements related to engineering geography, the Fuzhou operations are public knowledge worth noting.

Has Foxit been hacked?

Yes, once publicly: in August 2019, Foxit disclosed a breach of its My Account web service, exposing 328,549 user records including email addresses, passwords, names, phone numbers, company names, and IP addresses. Payment card details were not exposed. The breach affected the account infrastructure, not document content processed locally in Foxit PDF Editor. Foxit responded by forcing password resets, notifying regulators under GDPR, hiring external security firms, and has since significantly expanded its compliance certifications (SOC 2 Type II, ISO 27001). If you had a Foxit account before 2019 and reuse that password elsewhere, it is worth rotating it.

How long does Foxit keep my files?

It depends entirely on which Foxit product you use:

Foxit PDF Editor desktop in off-grid mode: files are never uploaded — they stay on your computer
Foxit Cloud (optional sync/collaboration): retained per your account configuration until you delete
Foxit AI Assistant: document text sent to Microsoft Azure AI is retained by Azure for up to 48 hours before purging
Foxit eSign: signed documents are retained per legal requirements for audit trail purposes
My Account web data: account information is retained per Foxit's privacy policy

With a browser-based tool like HonestPDF, no upload occurs at all on any tool, so retention does not apply.

Is Foxit GDPR compliant?

Yes. Foxit has a designated data protection officer, EU operations based in Dublin, Ireland, and documented GDPR compliance including user rights (access, rectification, erasure, portability, objection). Foxit is also CCPA and CPRA compliant for California residents. For organizations using Foxit Cloud or AI services under GDPR, third-party processors (including Microsoft Azure) are disclosed in Foxit's privacy policy.

Does Foxit support HIPAA?

Yes, Foxit supports HIPAA compliance and offers a Business Associate Agreement (BAA) for qualifying healthcare customers. Foxit's trust center explicitly states: "Foxit maintains security and privacy controls aligned with the HIPAA Security Rule requirements to help customers meet their compliance obligations. Where applicable, we are prepared to enter into a Business Associate Agreement." This puts Foxit in a small minority of PDF vendors with an available BAA — most free SaaS PDF tools do not offer one.

Is Foxit safe for legal or medical documents?

For the paid desktop Editor in off-grid mode with a signed BAA (for HIPAA) or DPA (for GDPR), Foxit is among the most credentialed PDF tools available for legal and medical documents. The combination of SOC 2 Type II, ISO 27001, HIPAA BAA availability, off-grid mode, and US enterprise accountability satisfies most regulated-industry procurement checklists. For free-tier users, mobile app users without enterprise configuration, or anyone using Foxit AI Assistant with Azure backend on sensitive content — the exposure profile is different and needs separate evaluation. A browser-based PDF tool that never transmits the file is structurally simpler to defend in compliance reviews because there is no cloud data flow at all.

What is Foxit "off-grid" mode?

Off-grid mode is a formally supported Foxit configuration that disables all cloud service access in the software. In this mode, Foxit PDF Editor operates as a purely local application — documents are processed entirely on the user's computer, with no uploads, no cloud sync, no AI calls, no eSign, and no telemetry. Organizations with high-security requirements (government, defense, financial services, healthcare) deploy Foxit in off-grid mode via Group Policy or Active Directory. This is Foxit's strongest privacy posture and is what makes the desktop Editor legitimately private when configured correctly.

Can I use Foxit PDF Editor offline?

Yes, Foxit PDF Editor is primarily desktop software and runs offline after installation and license activation. For AI Assistant, eSign, and cloud sync features, internet access is required. For pure editing, redaction, form filling, OCR, and signing, no internet connection is required on the desktop app. For consistent offline operation without a paid license, a browser-based tool that loads once and then runs locally is the zero-cost equivalent.

The bottom line

Foxit is, structurally, a different conversation than Smallpdf, iLovePDF, PDF24, or PDFCandy. It is not a free cloud PDF toolkit — it is enterprise-grade desktop software with optional cloud add-ons. For power users and organizations willing to pay for a licensed Editor and configure off-grid mode, Foxit is among the most credentialed and capable PDF applications available, with strong compliance posture (SOC 2 Type II, ISO 27001, HIPAA BAA available) and the ability to operate entirely locally.

The real privacy considerations with Foxit are not about the core desktop editing workflow in off-grid mode. They are about:

The 2019 My Account breach, which affected web account data but not document content, and is a reminder that account systems are always a separate attack surface
The AI Assistant routing document text through Microsoft Azure for up to 48-hour retention — a different data flow than local editing
Cloud features (Cloud sync, eSign, mobile apps) that are cloud by design and appropriate for their use case but should not be confused with off-grid desktop work
The fact that cloud features are enabled by default, so a user expecting "installed software = private" needs to actively configure off-grid mode

If you handle confidential PDFs regularly and want Adobe-alternative enterprise features at roughly half the cost, Foxit PDF Editor in off-grid mode is a legitimate choice. If you want a default-private experience with no configuration, no licensing, no account that could be breached, and no cloud AI retention policy to worry about — a browser-based PDF tool that processes files locally on any device is the structurally simpler option.

Try HonestPDF's privacy-first PDF tools: every tool runs entirely in your browser, works on every operating system, with no uploads, no accounts, no subscriptions, and no configuration required for privacy.

Related Privacy Reviews

If you are exploring different PDF software and their privacy policies, you might also find our other security breakdowns helpful: