# Security and privacy > How AdScaled Converter protects your files and account: in-browser processing, CSP, encrypted secrets, two-factor authentication. The safest file is the one you never send anywhere. That is why the converter processes files right in your browser – and everything else is protected by the layers described below. Updated 24 Sep 2026 - Files stay with you: In-browser conversion sends nothing – not even to our server. - Content is never stored: Not even with the API: memory only, then discarded. - Encrypted secrets: Payment and e-mail credentials are stored encrypted. - Two-factor authentication: Protect your account with an app code and backup codes. ## In-browser processing The converter and PDF tools run in your browser, in a separate thread (Web Worker). Files are not sent anywhere – conversion even works offline. - We detect the format from the actual file content, not just the extension. A file whose extension does not match its content is refused. - Oversized, suspicious or unsupported files are refused before processing starts. Video and audio are never processed. - SVG is rendered as an image only – scripts and external references inside never run. - EXIF and GPS data are removed when images are converted. - Conversions run one after another with a time limit so they don’t overload your computer. ## Website protection The website sends strict security headers that limit what the page is allowed to do: - Content Security Policy allows scripts and network connections only to our own domain – the page technically cannot send your files anywhere else. - HTTPS only (HSTS), no framing by other sites (clickjacking protection), nosniff and a strict Referrer-Policy. - Changes to a signed-in account are protected against CSRF by checking the request origin. - All endpoints have request rate limits against flooding and guessing. ## API and server Files sent through the API are processed on the server in memory only and discarded right after the result is sent. - File contents are never written to disk or a database. - File size is checked before the request is read; compressed request bodies are refused. - Conversions run in a queue with a limited number of concurrent jobs and time limits. - Per-minute request limits and monthly quotas are counted per user, not per key. - XML and YAML are parsed with entities disabled and an alias limit; SVG with external references or scripts is refused. ## Accounts and sign-in - Passwords are stored only as a hash (scrypt). Common and easily guessed passwords are refused. - Two-factor authentication (TOTP) with one-time backup codes. - E-mail alerts on sign-in from a new device and an overview of active sessions you can end. - Failed sign-in limits per IP address and per account; sign-up is protected by a computational check against bots. - The session cookie is HttpOnly, Secure and SameSite. Changing your password signs out all other devices. ## API keys - You see the full key only once, when it is created. We store only its hash (SHA-256), so nobody can read it from the database. - You can restrict a key’s permissions, allowed IP addresses and expiry. - Repeated attempts with invalid keys from one address are temporarily blocked. ## Server secrets Payment and e-mail credentials are stored encrypted on the server (AES-256-GCM) with the master key kept outside the application. The application server listens only locally behind a reverse proxy and runs with restricted privileges. ## Payments Payments are processed by Stripe. Your card number never passes through our server and we have no access to it. ## What we store - E-mail, password hash, language and plan of the account. - API conversion counts for limits and billing. - Conversion history only when you enable it – and only the file name, formats and sizes, never the content. - Security records (e.g. sign-ins) with a hash of the IP address, not the address itself. - [Privacy policy](https://converter.adscaled.media/en/privacy.md) ## Reporting a vulnerability Found a security issue? Write to contact@adscaled.media. The contact is also listed in /.well-known/security.txt. We will get back to you as soon as possible – and thank you for disclosing responsibly. ## Pages - [Converter](https://converter.adscaled.media/en/index.md) - [All conversions](https://converter.adscaled.media/en/conversions.md) - [PDF tools](https://converter.adscaled.media/en/pdf-tools.md) - [YouTube to MP3](https://converter.adscaled.media/en/youtube-to-mp3.md) - [YouTube to MP4](https://converter.adscaled.media/en/youtube-to-mp4.md) - [Pricing](https://converter.adscaled.media/en/pricing.md) - [API for developers](https://converter.adscaled.media/en/developers.md) - [Security and privacy](https://converter.adscaled.media/en/security.md) - [About](https://converter.adscaled.media/en/about.md) - [Contact](https://converter.adscaled.media/en/contact.md) - [Terms of service](https://converter.adscaled.media/en/terms.md) - [Privacy policy](https://converter.adscaled.media/en/privacy.md) ## Popular conversions - [PNG → WebP](https://converter.adscaled.media/en/convert/png-to-webp.md) - [JPG → WebP](https://converter.adscaled.media/en/convert/jpg-to-webp.md) - [WebP → JPG](https://converter.adscaled.media/en/convert/webp-to-jpg.md) - [JPG → PDF](https://converter.adscaled.media/en/convert/jpg-to-pdf.md) - [PNG → ICO](https://converter.adscaled.media/en/convert/png-to-ico.md) - [CSV → Excel](https://converter.adscaled.media/en/convert/csv-to-excel.md) - [JSON → CSV](https://converter.adscaled.media/en/convert/json-to-csv.md) - [Markdown → HTML](https://converter.adscaled.media/en/convert/markdown-to-html.md) ## Languages - [Čeština](https://converter.adscaled.media/zabezpeceni.md) - [Русский](https://converter.adscaled.media/ru/bezopasnost.md) - [Deutsch](https://converter.adscaled.media/de/sicherheit.md) - [Français](https://converter.adscaled.media/fr/securite.md) ## AdScaled products - [AdScaled BG Remover](https://bgremover.adscaled.media/): Remove backgrounds, objects, metadata and more, free in your browser - [AdScaled LinkBoard](https://linkboard.adscaled.media/): Send links, text and files between your devices, no sign-up - [AdScaled Shop](https://e-shop.adscaled.media/en/): Marketplace of independent shops - [Made by the AdScaled agency](https://www.adscaled.media/en/) --- Security and privacy | AdScaled Converter - URL: https://converter.adscaled.media/en/security - E-mail: contact@adscaled.media