Security and data protection

This page is the short, plain version of how ConvertFile protects your files. The detailed rules are on how we handle files and in the privacy policy.

Most tools never receive your file

60 of our 64 tools run entirely in your web browser: Merge PDF, Split PDF, Remove pages, Extract pages, Reorder pages, Rotate PDF, Resize PDF pages, Crop PDF, JPG and PNG to PDF, PDF to JPG or PNG, PDF to Word, PDF to text, PDF to HTML, PDF to Markdown, Add page numbers, Add watermark, Fill PDF forms, Flatten PDF, Sign PDF, Protect PDF, Edit PDF metadata, Redact PDF, Sign with a certificate, Unlock PDF, Compare PDFs, OCR PDF, Image converter, Resize and compress images, Video editor, Screen recorder, Video recorder, Merge videos, Add audio to video, Trim video, Add image to video, Add text to video, Remove logo from video, Crop video, Rotate video, Flip video, Resize video, Loop video, Change video volume, Change video speed, Stabilise video, Trim audio, Change volume, Change speed, Change pitch, Equaliser, Reverse audio, Voice recorder, Audio joiner, Extract audio, Audio converter, Video converter, Font converter, Archive converter, eBook converter, Archive extractor. Your browser downloads our code and does the work on your device. The file, its name and its contents are not uploaded, logged or sent to analytics. That includes passwords you type into Protect PDF and Unlock PDF, and certificates you use with Sign with a certificate.

3 tools need our server because the software they use can't run in a browser: Compress PDF; Repair PDF; Word, Excel and PowerPoint to PDF. Each of these tool pages says “Server-processed” before you add a file.

Encryption

• Pages and uploads travel over HTTPS, so files are encrypted in transit between your browser and us.
• Uploaded files are kept in private Cloudflare R2 storage, which encrypts stored files at rest. The storage is not publicly reachable, and each file is saved under a random name.
• Downloads use signed links that expire after 60 seconds and only work for the browser session or account that started the job.

Exactly when files are deleted

• Your original upload is deleted as soon as processing finishes.
• The processed result is deleted about 60 minutes after it is ready. You can delete it sooner with “Delete from server now”, or from your dashboard.
• If processing fails, files are deleted straight away. Jobs that never finish are cancelled and deleted after 120 minutes.
• A cleanup task runs every five minutes, so a file can outlast its deadline by a few minutes.
• Database backups contain job records, not files. We don't back up uploaded files.

Who can reach a file

• Only the browser session or account that uploaded a file can check its status or download the result.
• Processing runs in a separate child process that receives only that job's files. It has no database, storage or payment credentials.
• Our admin screens show job records (tool, time, sizes, status and error codes), never file names or contents. A person with access to our storage account could technically reach a file during its short retention window. We don't open or read uploaded files.
• We don't sell documents, analyse their contents or use them to train AI models.

Accounts

You don't need an account to use any tool. If you create one, your password is stored only as a hash, never in plain text, and you can delete the account yourself in your settings. Deleting it removes your profile, preferences, sessions and any files from your server jobs straight away.

Analytics and advertising

• We count that a tool was started, completed or failed, with the tool name and plan type. These counts carry no IP address, account, file name or file contents.
• Our pages load Google AdSense ads and Google Analytics and Microsoft Clarity. They see that you visited a page, as on most websites, and may set cookies; the privacy policy explains them and how to opt out. They never receive your files, because files are never sent to them.
• Microsoft Clarity records how pages are used (clicks, scrolling and page layout) so we can fix confusing pages. The tool area, recent files, your dashboard and every form field are masked before anything leaves your browser, so recordings never contain file names, file contents, passwords or anything you type.

Your privacy rights

ConvertFile is run from Victoria, Australia, and handles personal information under the Australian Privacy Principles. Visitors in the European Union and the United Kingdom also have rights under the GDPR and UK GDPR. Wherever you are, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it, or delete it (you can also delete your account yourself);
• stop using it for a purpose you object to.

Send requests through the contact page. If you aren't happy with our answer, you can complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live. Our providers (Railway for hosting, Cloudflare for storage, Resend for email) may process data outside Australia, including in the United States.

What we don't claim

ConvertFile is run by one person. We don't hold security certifications such as ISO 27001 or SOC 2, and we haven't had an external security audit. For documents that must never leave your device, use one of the 60 in-browser tools.

Reporting a security problem

If you find a vulnerability, please tell us through the contact page before publishing it, and we'll fix it as quickly as we can.

Common questions