# Security

> How Converterrr keeps files safe: in-browser WebAssembly conversion, isolated single-use cloud sandboxes, encryption in transit and at rest, and automatic deletion.

URL: https://www.converterrr.com/security

The safest file is one that never leaves the device: Converterrr converts in the browser whenever it can, isolates everything it can't, and deletes files automatically.

## In-browser conversion

- Most conversions, including images, most audio and video, and many documents, run entirely in the browser tab with open-source engines compiled to WebAssembly (FFmpeg, libvips, ImageMagick, Pandoc) and the browser's WebCodecs and canvas APIs.
- Files are read with the File API and processed in memory, in background workers. Neither the file nor the result is sent to Converterrr's servers; this can be verified in the browser's network panel.
- Converter pages are cross-origin isolated (COOP and COEP), and the engines are served from www.converterrr.com, not third-party CDNs.

## Cloud conversion in isolated sandboxes

Formats that need native tools (for example LibreOffice for Office documents, Calibre for eBooks), files too large for the device, and every API job run in the cloud:

- The browser uploads the file directly to temporary storage (Vercel Blob) with a short-lived, single-purpose upload token that enforces the plan's size limit.
- The job runs in a fresh Vercel Sandbox microVM created for that job, with its own kernel and filesystem. It can't see other jobs and is discarded when the conversion finishes or times out.
- Results are stored under a random, unguessable path and are only listed in the owner's account or returned to their API client.
- Jobs are queued and retried by Inngest, which only receives job IDs and metadata, never file contents.

## Automatic deletion

A cleanup job runs every 15 minutes and permanently deletes expired files. Source files from failed or cancelled jobs are deleted within about an hour. Deleted files can't be recovered. Results are kept for 1 hour to 7 days, depending on the plan:

| Plan | Result kept for | Uploaded source |
| --- | --- | --- |
| Signed out and Free | 1 hour | Deleted with the result |
| Starter | 24 hours | Deleted with the result |
| Pro | 3 days | Deleted with the result |
| Business | 7 days | Deleted with the result |

## Encryption and accounts

- HTTPS everywhere with HSTS preload; files, database records and backups are encrypted at rest (AES-256).
- Passwords are hashed with scrypt; API keys are stored only as hashes and shown once.
- Email verification is required before using the API or buying a plan. Sign-in and verification flows are rate limited.
- API keys can be revoked instantly, and each key is rate limited. Webhooks are signed with HMAC-SHA256 and a timestamp.
- Fair-use limits for signed-out visitors use a keyed one-way hash of the IP address, not the raw address.
- Payments are handled by Stripe (PCI DSS Level 1); card details never touch Converterrr's servers.

## Responsible disclosure

Report vulnerabilities to support@converterrr.com with "Security report" in the subject. Only test against your own account and avoid degrading the service.