Is Foxit Safe in 2026? A Detailed Privacy Review

Q: How long does Foxit keep my files?

It depends entirely on which Foxit product you use: Foxit PDF Editor desktop in off grid mode: Foxit says the software performs no cloud service access, so files stay on your computer Foxit cloud storage (optional): files you save there are stored on Foxit cloud services; Foxit's site gives no fixed retention period for them Foxit AI features: Foxit's privacy policy gives 24 hours for some Azure AI services, up to 48 hours for Azure AI Language and no period for Azure OpenAI; AI chat histories may stay on Foxit's servers unless you turn that off Free online tools: Foxit says the original and processed files are deleted after processing Foxit eSign: a cloud service by design; we found no retention period for signed documents on the Foxit pages we checked in September 2026 My Account web data: Foxit's privacy policy says it keeps most account data until you stop being an active user With a browser-based tool like HonestPDF, no upload occurs at all on any tool, so retention does not apply.

Short answer: Foxit is a legitimate, enterprise-grade PDF company that launched in California in 2001 and is based in Fremont, California. Foxit says over 700 million users trust it, and its Trust Center lists SOC 2 (Type 2), GDPR support, HIPAA readiness (with a Business Associate Agreement available where applicable), TAA compliance, and support for eIDAS qualified electronic signatures in Foxit eSign. Foxit PDF Editor runs primarily as desktop software - when used in the "off grid" mode Foxit documents, the installed software performs no cloud service access. That is a genuinely private workflow. However, Foxit also operates My Account and cloud services that do collect user data, and the company disclosed a breach on August 30, 2019 that exposed My Account data: email addresses, passwords, names, phone numbers, company names, and IP addresses. Foxit told SecurityWeek the incident affected 328,549 users. For the core desktop editing workflow on a paid license, Foxit is among the most enterprise-credentialed options available. For users of the free online tools, AI features, mobile apps, or eSign services - the data exposure profile is different and worth understanding before committing to confidential documents.

This article walks through how Foxit actually handles your data in 2026, the 2019 breach and what it revealed, the difference between Foxit's desktop and cloud products, and the alternative architecture for users who prefer processing files with no upload at all.

What Foxit actually is (and isn't)

Unlike Smallpdf, iLovePDF, PDF24, or PDFCandy, Foxit is primarily desktop and enterprise software, not a free web PDF toolkit. The product lineup in 2026 is:

Foxit PDF Reader - free reader that views, annotates, fills forms and signs PDFs, but does not edit them (Windows, macOS, iOS, Android, web)
Foxit PDF Editor - paid application for Windows, macOS and the web for creating, editing, signing, OCR, redaction, form filling. As of September 2026 Foxit lists it at $129.99 per user per year, with monthly billing available from $10.99
Foxit PDF Editor+ - $159.99 per user per year, adding mobile apps for iOS and Android, Foxit eSign with 150 envelopes per year, and AI Smart Redact
Foxit PDF Editor 14 - a perpetual license for Windows and macOS, a one-time $209.99 per user
Foxit eSign - standalone electronic signature service (cloud-based)
Foxit Admin Console - centralized license and policy management for enterprises
Foxit cloud services - document management, collaboration, AI features
Free online tools - browser converters, OCR and merge tools that handle files on Foxit cloud servers and delete them after processing
Foxit PDF SDK - developer libraries for embedding PDF features in other apps

For a Foxit PDF Editor desktop user running in "off grid" mode, Foxit says no cloud service access is performed by the installed software. Editing happens on your local machine. This is meaningfully different from Smallpdf or iLovePDF, which are cloud-first by design.

For users of Foxit's cloud services, AI Assistant, eSign, mobile apps, free online tools, or My Account web features, the data flows are more cloud-dependent and involve third parties like Microsoft Azure AI services (for AI features) and various analytics providers.

Where Foxit is actually headquartered

Foxit has historically been the subject of online speculation about Chinese ownership. What Foxit itself publishes in 2026 is:

Company address: Fremont, California, USA - Foxit Software Inc., 39355 California Street, per its privacy policy; its About page says Foxit launched in California in 2001
European privacy contact: Berlin, Germany - Foxit Europe GmbH, named in the privacy policy for EU data protection questions
Other offices listed on the About page: Alpharetta, Dublin, Rotterdam, Skopje, Noida, Tokyo, and Melbourne

Foxit operates as a US-based global company. Its privacy policy names Foxit Software Inc. in California as the responsible body, with a data protection officer, and Foxit Europe GmbH in Berlin as the European office. Foxit also lists its main products as TAA compliant, which is what US federal procurement asks for.

We found no office in China on Foxit's About page when we checked in September 2026. Buyers with specific supply-chain requirements about where software is developed (e.g., certain US defense or intelligence contexts) should ask Foxit directly rather than rely on a marketing page. For most commercial and consumer users, this is not a practical concern.

Foxit's security and compliance posture

Foxit's published security position in 2026 is strong for the PDF category. This is what its Trust Center and security page list:

SOC 2 (Type 2) for security, availability, confidentiality, and privacy trust services criteria (PDF Editor and eSign)
GDPR support, with a data protection officer and a European office in Berlin named in the privacy policy
HIPAA ready, with Foxit "prepared to enter into a Business Associate Agreement" where applicable
CCPA and CPRA rights for California residents set out in the privacy policy, which also says Foxit does not sell personal information
TAA (Trade Agreements Act) compliance for US federal procurement eligibility
QES support for qualified electronic signatures in Foxit eSign when used with qualified trust service providers under eIDAS
21 CFR Part 11 support for life sciences electronic records and signatures (Foxit eSign)
Section 508 and ADA accessibility conformance
AES 256-bit encryption for data in transit between users and Foxit cloud services
Secure software development lifecycle with code review, vulnerability scans, and security testing
"Off grid" mode where, in Foxit's words, no cloud service access is performed by the installed software, for organizations with high-security requirements
JavaScript execution can be disabled for individual users or for the entire organization, for defense against PDF-embedded JavaScript attacks
Cross-domain resource access disabled by default in both Reader and Editor
Group Policy templates and SCCM/SCUP support for enterprise deployment and patching

We found no mention of an ISO information security certificate or of a US federal cloud authorization on Foxit's Trust Center or compliance pages when we checked in September 2026. If your procurement checklist needs either, ask Foxit for it in writing.

For procurement reviews in regulated industries - healthcare, finance, legal, government - Foxit clears much of the standard compliance checklist. It is one of the more enterprise-ready PDF products outside of Adobe Acrobat.

The 2019 My Account breach - what actually happened

The most significant item in Foxit's public security record is a data breach that Foxit disclosed in a notice dated August 30, 2019:

Third parties gained unauthorized access to Foxit's My Account user data
328,549 users were affected, a figure Foxit gave to SecurityWeek; Foxit's own notice gives no number
Exposed data included: email addresses, passwords, user names, phone numbers, company names, IP addresses
Not exposed: payment information. Foxit said it "does not keep customer credit card information in its systems"
Response: Foxit invalidated the passwords of all potentially impacted accounts and required resets, notified law enforcement agencies and data protection authorities, hired a security management firm for an in-depth analysis, and contacted affected users directly

My Account is Foxit's free membership service for software trial downloads, order histories, product registration information, and support information. The breach affected the web account system, not the PDF documents that users process through Foxit PDF Editor on their own computers.

What the breach did NOT expose:

Document content processed locally in Foxit PDF Editor
Files stored on users' own computers
Payment card information, which Foxit said My Account does not hold

What the breach raised concerns about:

How the passwords were stored: Foxit's notice does not say whether or how they were hashed
The security posture of the account-management infrastructure, which sits apart from the desktop software

Foxit's response to the breach was relatively transparent by industry standards - public disclosure, regulator notification, affected-user communication, and an outside security firm. Today its Trust Center lists a SOC 2 (Type 2) attestation and HIPAA readiness with a BAA available.

For anyone who had a Foxit My Account before 2019 and has reused the same email/password combination elsewhere, it is worth rotating that password even now. For users of the core desktop Editor without a cloud account tied to it, the breach did not affect document content.

Where the cloud parts of Foxit become the risk

Foxit PDF Editor used purely as desktop software is not a cloud privacy issue - the files stay on your computer. But several Foxit products and features do route data through servers:

Foxit Cloud (document sync and collaboration)

Files saved to Foxit's cloud for sharing, collaboration, or cross-device access are stored on Foxit cloud services, which Foxit says are hosted with Amazon Web Services in Virginia, Frankfurt and Montreal. These services are covered by Foxit's privacy policy and its SOC 2 attestation - but the structural fact is that the document leaves your device. For confidential documents, routing them through a vendor cloud is the same category of decision as using Smallpdf: third-party server exposure, regardless of certification.

Foxit AI Assistant (Microsoft Azure AI)

Foxit's AI features for summarization, rewriting, translation, and Q&A use Microsoft Azure AI services as a backend. Foxit's privacy policy gives a different answer for each of them. Files processed by Azure AI Document Intelligence and the OCR service are deleted within 24 hours, text sent to Azure AI Language may be stored for up to 48 hours, and text-to-speech input is not stored at all. Azure OpenAI, which handles summarizing and rewriting, comes with no retention period in the policy. Foxit may also keep your AI chat histories on its own cloud servers for as long as it needs them, unless you choose not to store them. This means that when you use Foxit's cloud AI features on a document:

The document text is sent to Microsoft Azure
Azure processes it to produce a summary, rewrite, or answer
Depending on the service, Azure deletes it within 24 or 48 hours, or the policy gives no period at all
Your chats with the AI may be kept on Foxit's servers unless you turn chat history storage off

For a casual use case, this is a reasonable trade-off. For confidential legal briefs, medical records, financial statements, or source code - sending the text to Microsoft Azure, with retention that depends on the service, is a meaningful data-flow that your compliance team should know about. Foxit also says a local AI option in Foxit PDF Editor keeps documents on the device with no cloud processing. This is not specific to Foxit; it is a property of cloud AI in general.

Foxit eSign

Electronic signatures need an audit trail and the signed document kept for legal validity. Foxit eSign is a cloud service, similar to DocuSign or Adobe Sign. This is appropriate for the product category but means those specific documents are not "off grid."

Foxit mobile apps

The mobile apps come with the PDF Editor+ plan. Foxit's free online tools (converters, OCR, merge) state on the page that "your files will be securely handled by Foxit cloud servers", and that the original and processed files are deleted afterwards. No account is required for them, but the file does leave your device.

My Account, website analytics, marketing

The foxit.com website uses Google Analytics 4, HubSpot, VWO (A/B testing), and other marketing tools, all named in Foxit's privacy policy. These do not see document content but do collect standard web analytics and marketing interaction data.

"Off-grid" mode - the genuinely private Foxit workflow

Foxit's differentiator versus most PDF vendors is a documented "off grid" operational mode. From Foxit's security page:

Foxit offers users and organizations the option to operate the software in complete “off grid” mode, where no cloud service access will be performed by the software installed by users. This capability offers additional deployment and operational flexibility for organizations with high level of security needs.

In practice, a hardened setup looks like this:

Foxit PDF Editor installed as a licensed desktop application
Off grid operation enabled, so the software performs no cloud service access
JavaScript execution disabled for PDF documents (defense against malicious PDFs)
Cross-domain resource access left disabled, which is the default
No cloud AI, eSign, or cloud document storage, since each of those is a cloud service

In this configuration, Foxit PDF Editor is a local PDF application. No document content leaves your computer during normal editing, redaction, form filling, or signing workflows. This is a genuinely private workflow and is why Foxit is a credible option in regulated environments.

The catch: off grid is an option, not a guarantee. Foxit describes it as something users and organizations choose, and editing itself needs a paid Foxit PDF Editor plan or license. Users who expect "installed software = private" should check how their copy is configured.

Where Foxit costs matter

Independent of privacy, Foxit's practical characteristics in 2026:

Not free for full editing - Reader is free, but Editor is $129.99 per user per year, or from $10.99 a month on annual billing
Volume licensing requires a quote for 30 or more licenses
AI Assistant is a $49.99/year add-on with 2,000 credits/month; every Foxit account already includes 300 credits a month
A perpetual license exists (Foxit PDF Editor 14, $209.99 one-time, Windows and macOS) but does not include the AI Assistant, Smart Redact, document management, or cloud features
Mobile apps require the PDF Editor+ subscription ($159.99 per user per year)
Learning curve - Foxit describes a familiar ribbon-style interface, which Microsoft Office users will recognize but which can feel dense for casual users

For an individual or small team processing 10+ PDFs per week, Foxit is significantly cheaper than Adobe Acrobat: Foxit itself puts PDF Editor+ at 44% below Acrobat Pro for Teams. For occasional PDF work, Foxit's pricing may be overkill.

How browser-based PDF tools change the model

There is a fundamentally different architecture that has matured significantly since 2023: PDF processing that runs entirely inside your browser using WebAssembly. No upload, no server-side processing, no retention window to worry about, because the document never leaves your device in the first place. This works on every operating system that runs a modern browser - Windows, macOS, Linux, ChromeOS, iOS, and Android - without installing any software or managing licenses.

This is the architecture HonestPDF uses. When you merge, redact, sign, compress, or convert a PDF, all of the processing happens in your browser using the same compute resources that render the page you are reading. There is no upload endpoint for tool files, no account system to breach (like Foxit's 2019 My Account incident), and no cloud AI service holding your document text.

The trade-offs are honest. Foxit PDF Editor has capabilities browser-based tools do not yet match - OCR with suspect correction, AI-powered Smart Redact with PII detection, qualified electronic signature workflows through Foxit eSign, an MCP server for AI agents, comprehensive form design, and Microsoft 365 integration. For an enterprise compliance officer doing heavy PDF work with a licensed desktop application configured correctly, Foxit is a legitimate secure choice.

For everyday privacy-sensitive work - redaction, merging, simple signing, compression, conversion, basic OCR - the browser-based model removes categories of risk that even a well-configured enterprise tool creates.

Side by side: when each approach makes sense

Foxit is a reasonable choice when:

You are a professional or enterprise user willing to pay $10.99 a month or more for full PDF editing
You will run it off grid, or otherwise keep cloud services out of sensitive work
You need SOC 2 (Type 2) and a HIPAA Business Associate Agreement on your procurement checklist
You need eIDAS qualified electronic signature workflows through Foxit eSign
You need Group Policy and SCCM integration for enterprise deployment
You are replacing Adobe Acrobat and want comparable features at lower cost

A browser-based tool like HonestPDF is the safer choice when:

The document is confidential, legally privileged, or regulated - and you want "no upload" as a structural guarantee, not a configuration choice
You are on macOS, Linux, iOS, Android, or ChromeOS and don't want to install and license desktop software
You don't want to pay a subscription for occasional PDF work
You don't want to manage accounts that could be breached (the 2019 My Account incident is a real example)
You want a default-private experience without configuration
You simply prefer the documents you process to never leave your device, regardless of server certifications or off-grid toggles

Neither approach is universally correct. Foxit PDF Editor with off-grid mode is a genuinely strong enterprise privacy posture when correctly configured. The questions are whether you will actually configure it correctly, whether you need the paid enterprise feature depth, and whether you want "private" to be a default or a setting.

A practical workflow recommendation

For most professionals, the cleanest workflow in 2026 looks like this: use a browser-based tool by default for quick privacy-sensitive tasks (redaction, merging, signing, form filling) because it is instantly private on any device with no configuration. Reserve Foxit PDF Editor for power-user workflows where you genuinely need advanced features - heavy OCR, Smart Redact with AI, qualified signatures through Foxit eSign, heavy form design - and run it off grid for sensitive documents.

This gives you two tools for two job sizes: a frictionless private default for the majority of PDF work, and a paid enterprise application for the minority of tasks that genuinely need it.

Frequently asked questions

Is Foxit safe to use?

Foxit PDF Reader and Foxit PDF Editor are legitimate, widely-used software from a California-based company with strong enterprise compliance credentials (SOC 2 Type 2, GDPR support, HIPAA ready with a BAA available). Foxit says over 700 million users trust its products. The main public security incident is the 2019 My Account breach, which Foxit told SecurityWeek affected 328,549 users - it affected the account system, not document content processed on users' computers. For desktop PDF editing run off grid, Foxit is among the most compliance-credentialed options available.

Is Foxit owned by China?

Foxit's own pages describe a US company: its About page says Foxit launched in California in 2001, and its privacy policy names Foxit Software Inc. in Fremont, California as the responsible body, with Foxit Europe GmbH in Berlin as the European office. Foxit also lists its main products as TAA compliant for US federal procurement. We found no office in China on Foxit's About page when we checked in September 2026. Buyers with specific supply-chain requirements about where software is developed should ask Foxit directly.

Has Foxit been hacked?

Yes, once publicly: on August 30, 2019, Foxit disclosed unauthorized access to its My Account web service, exposing email addresses, passwords, names, phone numbers, company names, and IP addresses. Foxit told SecurityWeek that 328,549 users were affected. Foxit said no payment information was exposed. The breach affected the account infrastructure, not document content processed locally in Foxit PDF Editor. Foxit responded by forcing password resets, notifying law enforcement agencies and data protection authorities, and hiring an external security firm. If you had a Foxit account before 2019 and reuse that password elsewhere, it is worth rotating it.

How long does Foxit keep my files?

It depends entirely on which Foxit product you use:

Foxit PDF Editor desktop in off grid mode: Foxit says the software performs no cloud service access, so files stay on your computer
Foxit cloud storage (optional): files you save there are stored on Foxit cloud services; Foxit's site gives no fixed retention period for them
Foxit AI features: Foxit's privacy policy gives 24 hours for some Azure AI services, up to 48 hours for Azure AI Language and no period for Azure OpenAI; AI chat histories may stay on Foxit's servers unless you turn that off
Free online tools: Foxit says the original and processed files are deleted after processing
Foxit eSign: a cloud service by design; we found no retention period for signed documents on the Foxit pages we checked in September 2026
My Account web data: Foxit's privacy policy says it keeps most account data until you stop being an active user

With a browser-based tool like HonestPDF, no upload occurs at all on any tool, so retention does not apply.

Is Foxit GDPR compliant?

Foxit's Trust Center lists "GDPR Support", and its privacy policy names a data protection officer, a European office (Foxit Europe GmbH in Berlin, Germany), and the GDPR user rights (access, rectification, erasure, portability, objection). The same policy sets out CCPA and CPRA rights for California residents. For organizations using Foxit cloud or AI services under GDPR, third-party processors (including Microsoft Azure) are disclosed in Foxit's privacy policy.

Does Foxit support HIPAA?

Foxit describes itself as "HIPAA Ready" and offers a Business Associate Agreement (BAA) where applicable. Foxit's trust center explicitly states: "Foxit maintains security and privacy controls aligned with the HIPAA Security Rule requirements to help customers meet their compliance obligations. Where applicable, we are prepared to enter into a Business Associate Agreement." This puts Foxit in a small minority of PDF vendors with an available BAA - most free SaaS PDF tools do not offer one.

Is Foxit safe for legal or medical documents?

For the paid desktop Editor run off grid, with a signed BAA (for HIPAA) or DPA (for GDPR), Foxit is among the most credentialed PDF tools available for legal and medical documents. The combination of SOC 2 (Type 2), HIPAA readiness with a BAA, off grid operation, and a US responsible entity satisfies many regulated-industry procurement checklists. For users of the free online tools, mobile app users, or anyone using Foxit's cloud AI features on sensitive content - the exposure profile is different and needs separate evaluation. A browser-based PDF tool that never transmits the file is structurally simpler to defend in compliance reviews because there is no cloud data flow at all.

What is Foxit "off-grid" mode?

"Off grid" is Foxit's name for running its software with no cloud service access. Foxit describes it as an option for users and organizations "with high level of security needs", alongside disabling JavaScript execution and cross-domain resource access. In this mode, Foxit PDF Editor operates as a local application - documents are processed on the user's computer, and cloud features such as cloud AI, eSign and cloud storage are out of the picture. This is Foxit's strongest privacy posture and is what makes the desktop Editor legitimately private when configured correctly.

Can I use Foxit PDF Editor offline?

Foxit PDF Editor is primarily desktop software, and its off grid mode is built for working without cloud access. For cloud AI, eSign, and cloud storage features, internet access is required. Foxit's site does not spell out how activation works without a connection, so check that with Foxit before relying on it. For consistent offline operation without a paid license, a browser-based tool that loads once and then runs locally is the zero-cost equivalent.

Ready to switch?

If you have read this far and decided you want free PDF tools without a paid license, install, or account, the next question is usually how the tools compare side by side. We built a detailed feature-by-feature comparison covering pricing, what the free Reader does and does not do, and where each tool fits: HonestPDF vs Foxit.

The bottom line

Foxit is, structurally, a different conversation than Smallpdf, iLovePDF, PDF24, or PDFCandy. It is not a free cloud PDF toolkit. It is enterprise-grade desktop software with optional cloud add-ons. For power users and organizations willing to pay for a licensed Editor and run it off grid, Foxit is among the most credentialed and capable PDF applications available, with a strong compliance posture (SOC 2 Type 2, HIPAA ready with a BAA available) and the ability to operate entirely locally.

The real privacy considerations with Foxit are not about the core desktop editing workflow in off grid mode. They are about:

The 2019 My Account breach, which affected web account data but not document content, and is a reminder that account systems are always a separate attack surface
The cloud AI features routing document data through Microsoft Azure, with retention that varies by service and no stated limit for summarizing and rewriting, a different data flow than local editing
Cloud features (cloud storage, eSign, free online tools) that are cloud by design and appropriate for their use case but should not be confused with off grid desktop work
The fact that off grid is an option you or your administrator choose, so a user expecting "installed software = private" needs to check the configuration

If you handle confidential PDFs regularly and want Adobe-alternative enterprise features at a lower cost, Foxit PDF Editor in off grid mode is a legitimate choice. If you want a default-private experience with no configuration, no licensing, no account that could be breached, and no cloud AI retention policy to worry about, a browser-based PDF tool that processes files locally on any device is the structurally simpler option.

Try HonestPDF's privacy-first PDF tools: every tool runs entirely in your browser, works on every operating system, with no uploads, no accounts, no subscriptions, and no configuration required for privacy.

Related Privacy Reviews

If you are exploring different PDF software and their privacy policies, you might also find our other security breakdowns helpful: