Trust & Security
This page only describes controls we've actually implemented — we don't claim certifications we haven't obtained.
Data protection
Files are stored under randomized identifiers, never by their original filename. Only sanitized metadata (name, size, type) is kept in the database.
File handling
Uploaded files are validated by magic bytes (not just extension) before processing. Conversions run with argument-array process execution — never shell string interpolation — to prevent command injection.
Encryption
All traffic to the app is served over HTTPS/TLS in production. Files are encrypted in transit.
File retention
Files are deleted automatically after a configurable retention period (60 minutes by default). You can also delete a file immediately after conversion.
Local processing
Simple image conversions run entirely in your browser when technically possible — the file never reaches our servers for those operations.
Server processing
Conversions that require a real document/OCR/video engine run on our servers, in isolated worker processes, with per-job timeouts.
Account security
Passwords are hashed with bcrypt. Sessions are signed, HTTP-only cookies.
Vulnerability reporting
Found a security issue? Email security@universalfileconvert.com.