Security & Compliance

Our commitment to security & privacy

PrivConvert was built with security by design and privacy by design at its core. Every conversion is processed in memory with no permanent storage - and the service undergoes comprehensive security testing on an ongoing basis.

  • No file storage
  • TLS encrypted
  • Security by design
  • Privacy by design
  • Independently tested

01 · Pipeline

How a file moves through PrivConvert

Every upload passes through six layers of protection, from the moment it leaves your device to the moment it is erased.

  1. 01 Edge

    Encrypted in transit and screened before it reaches the converter.

  2. 02 Validation

    Every file is checked before anything is processed.

  3. 03 Memory

    Processed in memory, never written to disk.

  4. 04 Isolation

    Each job runs contained, apart from everything else.

  5. 05 Delivery

    Returned straight to you, never cached.

  6. 06 Purge

    Erased the moment the job is done.

02 · Principles

Security by design

Built secure from the ground up

Security is not a layer we add at the end - it shapes every decision. From how files enter the system to how they leave, each step is designed to minimise risk, limit exposure, and keep your data protected throughout the conversion process.

Privacy by design

Privacy is the default, not an option

We collect as little as possible and retain nothing you upload. No sign-up for the tools, no file storage, no behavioural profiles - privacy is built into the architecture so you never have to opt out of being tracked or worry about where your files end up.

03 · Testing

Comprehensive security testing

PrivConvert has undergone rigorous security assessments - including penetration testing, abuse simulation, and privacy validation - to verify that our security and privacy promises hold in practice. Testing is repeated before every major release and on an ongoing basis as the platform evolves.

Penetration testing
Regular assessments of the live service and conversion pipeline.
Abuse simulation
Automated and manual testing against malicious uploads and traffic.
Privacy validation
Ongoing checks that files are never stored, logged, or retained.
Continuous monitoring
Real-time protections and review before every major release.
Security Assessment Report Public summary of our latest assessment - verified by both a human security reviewer and AI-driven testing. No critical or high-severity findings.
Download PDF

04 · Technology

Technology

The technical measures that protect every upload and download.

TLS/HTTPS encryption

Every upload and download is encrypted in transit with industry-standard TLS. Your files are protected from interception between your device and our servers.

In-memory processing

Uploaded files are processed entirely in volatile memory. Nothing is written to permanent storage, so there is no disk copy to leak, recover, or breach.

Isolated processing

Each conversion runs in its own controlled environment. Your files are never mixed with other users’ uploads, and processing is kept separate from the rest of the system.

File validation

Every upload is checked for valid file type, size limits, and known threats before any conversion begins. Invalid or suspicious files are rejected automatically.

Secure API endpoints

The developer API uses authenticated requests and the same in-memory, zero-retention pipeline as the web tools. Files are never stored between calls.

Abuse & DDoS protection

Automated protections guard against bots, abuse, and denial-of-service attacks. Suspicious traffic is blocked before it can reach the conversion service.

05 · Privacy

Privacy & data handling

How we minimise data collection and ensure your files leave no trace.

Instant deletion

Files are purged from memory the moment your download completes - or after a short timeout if the connection drops. Nothing lingers on the server.

Zero file retention

We do not create backups, caches, thumbnails, or audit copies of your uploads. After processing, we have no ability to recover your files.

No account required

The conversion tools work without sign-up, so you never hand us an email, password or profile just to convert a file. Accounts exist only for paid API access.

Minimal logging

Ordinary conversions generate no persistent logs of filenames or file contents. We only retain the limited technical details needed to prevent abuse, and only for a short period.

Privacy-friendly analytics

We use cookieless, aggregate analytics to understand tool usage. No cross-site tracking, no fingerprinting, and no connection to your uploaded files.

Compliance-ready design

Because files are not stored and no personal data is needed to convert a file, PrivConvert fits workflows where data residency and retention rules apply. Hidden metadata - EXIF in photos, author details in documents, tags in audio - can also be stripped so shared files carry no identifying information.

06 · PrivLab

Security research behind the product

PrivConvert is built by topriv. Our PrivLab team publishes privacy and security research that informs how we design, test, and operate the service.

Explore PrivLab research

For legal details on data collection, cookies, and your rights, see our Privacy Policy. Questions? [email protected]

Get API Access →