Security & File Privacy

This page describes exactly where each tool processes your files, for how long anything is kept, and what our analytics can and cannot see. The same information appears on every tool page in the "How your file is processed" card; both are generated from one internal manifest, and our build refuses to publish if a tool's browser-vs-server designation contradicts its code path.

Tools that run in your browser

103 of our 126 tools process files entirely in your browser tab — the conversion engines (canvas codecs, pdf.js, pdf-lib, qpdf compiled to WebAssembly, Tesseract OCR) are downloaded to your device and run there. For these tools your file is not uploaded to us. We have verified this by recording the page's network activity during conversions and checking that no file-upload request is made — a check anyone can repeat in their browser's developer tools, and one we repeat whenever a conversion engine changes.

Converted results are kept in this browser's local storage for up to two hours so their matching download page can list them. Expired results are removed when you next use the site. You can clear them at any time by clearing this site's browser data. Nothing about your files is written to our servers.

Tools that use our conversion server

15 tools need native software that does not run reliably inside an ordinary browser tab and therefore upload your file. Every such page is labelled "Server conversion" next to the upload area before a file is selected.

Translators (8 tools)

These need a server and do not upload your file. The document is opened and rewritten in your browser tab; only the text taken out of it is sent to be translated, in batches, and only the translated text comes back. The finished file is assembled on your device. Their pages are labelled "Only the wording is sent" rather than "Server conversion", because the two are not the same promise. Translation runs on a LibreTranslate instance we host ourselves — no third-party translation API is involved, and the service is called without conversation storage.

Office / HTML / PDF-A engine (9 tools)

TIFF to PDF, CSV to PDF, EPUB to PDF, Markdown to PDF, Word to PDF Converter, Excel to PDF Converter, PowerPoint to PDF Converter, HTML to PDF Converter, PDF to PDF/A use Gotenberg (LibreOffice, headless Chromium or its PDF engine).

• The upload travels over HTTPS and is held in memory only on our proxy — it is never written to our application disk.
• The conversion engine (Gotenberg, running LibreOffice / headless Chromium) removes its per-job working files as soon as each conversion completes — its documented behaviour — and no job data is retained between conversions.
• Files are limited to 50 MB and a fair-use rate of 30 conversions per 10 minutes per visitor.
• Document macros are never executed — the engine only renders the file for conversion (LibreOffice's default security setting).

Native FFmpeg media engine (6 tools)

WebM to MP4 Converter, MOV to MP4 Converter, MP4 to MP3 Converter, WebM to MP3 Converter, M4A to MP3 Converter, WAV to MP3 Converter use fixed, allowlisted FFmpeg profiles; the browser cannot supply command arguments.

• The upload is capped at 100 MB and the output at 160 MB. The selected stream may be up to 10 minutes, 4K / 120 fps, 8 audio channels and 192 kHz; the complete upload, conversion, validation and response share one 8 minute deadline. One media job runs at a time, with a fair-use limit of four jobs per visitor per 10 minutes.
• The upload streams directly into a random, permission-restricted operating-system temporary directory instead of accumulating in application memory. FFmpeg and ffprobe work only inside that job directory; normal cleanup removes it after response completion, failure, cancellation or timeout. Startup and five-minute sweeps remove forced-crash leftovers once they are older than the request-wide deadline.
• The input extension is checked against its byte signature. ffprobe must find the required stream before conversion; the finished file must then expose the promised codec, pass the duration tolerance and decode completely before HTTP 200 is returned.
• Only the first relevant video/audio stream is used. Metadata, subtitles, chapters, artwork and extra streams are intentionally removed; DRM is never decrypted.

For both server families, request logs contain technical metadata (time, endpoint, IP, response size) for security and abuse prevention — not file contents. File names travel in a request header rather than the URL, so they stay out of standard access logs.

Online file virus scanner

The virus scanner uploads one file, up to 25 MB, to our server only after you select Scan file. A single ClamAV engine checks its contents without executing the uploaded file. The application holds the upload in temporary memory; engine working files use isolated temporary storage and are removed after processing. Files are not sent to VirusTotal or other analysis services, published, or added to a document library. The file name stays in your browser. Reports are returned to your browser and are not saved on the server.

Scans are limited to three requests per minute and ten per hour per IP address, with two simultaneous scans across the service. IP rate counters expire after an hour and are removed by a sweep every minute. Archive expansion is bounded; encryption and limit alerts produce an incomplete result. Unavailable or outdated definitions stop scanning. No threats detected means that this one engine found no match, not that a file is guaranteed safe. The scanner page has no third-party advertising or analytics scripts.

Optional AI second opinions

Every File Intelligence page first produces a deterministic report in your browser. On selected tools, a separate AI button appears after that report. Nothing is sent until you choose that button. The request contains extracted text and, where relevant, your question—not the original file—and is limited to 256 KB. The server rate-limits requests and keeps the API credential out of browser code.

The model call is configured with store: false, which asks the provider not to store the generated response through the Responses API. This is not presented as a universal zero-retention guarantee: provider-side abuse monitoring or retention can depend on the account configuration and current provider terms. Do not use the optional AI step when a contract or internal policy prohibits third-party processing; the local report remains available without it.

Per-tool summary

Per-tool notes (what a conversion preserves or loses) are shown on each tool page.

What analytics sees

We measure pageviews, tool usage counts, viewport sizes, ad performance, and anonymous conversion success/failure events (a tool name, an error code and a count — no identifiers, no file details). These beacons never contain file names, file contents, or extracted text. Until you make a consent choice, our own first-party beacon counts the pageview anonymously — no identifier is stored on or read from your device, and session identifiers exist only after you accept (declining turns the beacon off entirely). Google advertising and analytics cookies are controlled by the consent banner and, in EEA/UK/Switzerland, stay off until you accept.

Related pages

See the privacy policy for the formal statement, the testing methodology for how these claims are verified, and the changelog for when processing behaviour changes.