Security and privacy

The safest file is the one you never send anywhere. That is why the converter processes files right in your browser – and everything else is protected by the layers described below.

Illustration: files stay on your device, nothing is sent to a server

Updated 24 Sep 2026

  • Files stay with you: In-browser conversion sends nothing – not even to our server.
  • Content is never stored: Not even with the API: memory only, then discarded.
  • Encrypted secrets: Payment and e-mail credentials are stored encrypted.
  • Two-factor authentication: Protect your account with an app code and backup codes.

In-browser processing

The converter and PDF tools run in your browser, in a separate thread (Web Worker). Files are not sent anywhere – conversion even works offline.

  • We detect the format from the actual file content, not just the extension. A file whose extension does not match its content is refused.
  • Oversized, suspicious or unsupported files are refused before processing starts. Video and audio are never processed.
  • SVG is rendered as an image only – scripts and external references inside never run.
  • EXIF and GPS data are removed when images are converted.
  • Conversions run one after another with a time limit so they don’t overload your computer.

Website protection

The website sends strict security headers that limit what the page is allowed to do:

  • Content Security Policy allows scripts and network connections only to our own domain – the page technically cannot send your files anywhere else.
  • HTTPS only (HSTS), no framing by other sites (clickjacking protection), nosniff and a strict Referrer-Policy.
  • Changes to a signed-in account are protected against CSRF by checking the request origin.
  • All endpoints have request rate limits against flooding and guessing.

API and server

Files sent through the API are processed on the server in memory only and discarded right after the result is sent.

  • File contents are never written to disk or a database.
  • File size is checked before the request is read; compressed request bodies are refused.
  • Conversions run in a queue with a limited number of concurrent jobs and time limits.
  • Per-minute request limits and monthly quotas are counted per user, not per key.
  • XML and YAML are parsed with entities disabled and an alias limit; SVG with external references or scripts is refused.

Accounts and sign-in

  • Passwords are stored only as a hash (scrypt). Common and easily guessed passwords are refused.
  • Two-factor authentication (TOTP) with one-time backup codes.
  • E-mail alerts on sign-in from a new device and an overview of active sessions you can end.
  • Failed sign-in limits per IP address and per account; sign-up is protected by a computational check against bots.
  • The session cookie is HttpOnly, Secure and SameSite. Changing your password signs out all other devices.

API keys

  • You see the full key only once, when it is created. We store only its hash (SHA-256), so nobody can read it from the database.
  • You can restrict a key’s permissions, allowed IP addresses and expiry.
  • Repeated attempts with invalid keys from one address are temporarily blocked.

Server secrets

Payment and e-mail credentials are stored encrypted on the server (AES-256-GCM) with the master key kept outside the application. The application server listens only locally behind a reverse proxy and runs with restricted privileges.

Payments

Payments are processed by Stripe. Your card number never passes through our server and we have no access to it.

What we store

  • E-mail, password hash, language and plan of the account.
  • API conversion counts for limits and billing.
  • Conversion history only when you enable it – and only the file name, formats and sizes, never the content.
  • Security records (e.g. sign-ins) with a hash of the IP address, not the address itself.
  • Privacy policy

Reporting a vulnerability

Found a security issue? Write to contact@adscaled.media. The contact is also listed in /.well-known/security.txt. We will get back to you as soon as possible – and thank you for disclosing responsibly.

Popular conversions

Languages

AdScaled products