Your files, kept close.

The safest file is one that never leaves your device. That idea shapes the whole product: we convert in your browser whenever we can, isolate everything we can't, and delete files automatically instead of keeping them “just in case”.

Most conversions, including images, most audio and video, and many documents, run entirely in your browser tab. We ship proven open-source engines such as FFmpeg, libvips, ImageMagick and Pandoc compiled to WebAssembly, and use your browser's built-in WebCodecs and canvas APIs where they are faster.

• Files are read with the browser's File API and processed in memory, in background workers.
• Results are written straight back to your device. Neither the file nor the result is sent to our servers, and you can verify this in your browser's network panel.
• Converter pages are cross-origin isolated (COOP and COEP headers), which lets the engines use multiple threads safely and stops other sites from reading the page's memory.
• The engines are served from our own domain with immutable caching, not loaded from third-party CDNs.

Some formats need tools that can't run in a browser, such as LibreOffice for office documents or Calibre for ebooks, and some files are simply too large for a laptop. For these, and for every API job:

• Your browser uploads the file directly to temporary storage (Vercel Blob) using a short-lived, single-purpose upload token. The token expires after 30 minutes and enforces your plan's size limit.
• The job runs inside a fresh Vercel Sandbox microVM created for that job. It has its own kernel and filesystem, can't see other jobs or customers, and is stopped and discarded as soon as the conversion finishes or hits its time limit.
• The result is stored under a random, unguessable path and is only listed in your own account or returned to your API client.
• Jobs are queued and retried by Inngest, which only receives job IDs and metadata, never file contents.

A cleanup job runs every 15 minutes and permanently deletes every expired file from storage. Source files from failed or cancelled jobs are deleted within about an hour. Once a file is deleted, neither you nor we can recover it.

• In transit: every connection uses HTTPS with modern TLS. HSTS is enabled with preload, so browsers never fall back to plain HTTP.
• At rest: files, database records and backups are encrypted at rest by our infrastructure providers using AES-256.
• Secrets: passwords are hashed with scrypt, and API keys are stored only as hashes and shown once, when you create them.

• Session cookies are HttpOnly, Secure and SameSite, and sessions expire after 30 days of inactivity.
• Email verification is required before using the API or buying a plan.
• Sign-in, sign-up, password reset and verification emails are rate limited to stop brute-force attacks.
• Changing your password lets you sign out every other device, and password resets end all sessions.
• API keys can be revoked instantly, and each key is rate limited.
• Webhooks are signed with HMAC-SHA256 using a secret unique to your account, with a timestamp to prevent replay.
• Fair-use limits for signed-out visitors use a one-way, keyed hash of the IP address instead of the raw address.

Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card details are entered on Stripe's pages and never touch our servers.

• The application runs on Vercel's managed platform, with automatic security patching of the runtime.
• Access to production systems and data is restricted to the team members who need it.
• Secrets live in encrypted environment variables, never in source code.
• We keep dependencies, including the conversion engines, up to date and patch known vulnerabilities promptly.
• Our providers maintain independent security certifications such as SOC 2 Type II. See our list of subprocessors.

If you find a vulnerability, please tell us before telling anyone else. Email support@converterrr.com with “Security report” in the subject, steps to reproduce and the impact you observed.

• We will acknowledge your report within 3 business days and keep you updated as we fix it.
• Please only test against your own account, don't access other people's data, and avoid anything that degrades the Service, such as denial-of-service or spam.
• We won't pursue legal action for good-faith research that follows these guidelines, and we are happy to credit you once the issue is fixed.