Your documents, handled like they matter.

This page describes the security design we are building against. Where something is not live yet we say so; we would rather be checked than believed.

Own infrastructure, no third-party processors

Conversion runs on servers we operate in the European Union. Documents are never sent to external conversion or AI services. Storage is a private Cloudflare R2 bucket with no public access.

Encrypted in transit, short-lived links

All traffic uses TLS. Uploads and downloads go through signed links that are valid for minutes, bound to the exact file and size, and cannot be reused.

Deleted within one hour

Inputs, outputs and temporary artifacts are deleted within one hour of a job finishing, whether it succeeded or failed and whether or not you downloaded the result. A daily storage lifecycle acts as a backstop.

Isolated processing

Each conversion runs in an isolated process without network access or credentials, with limits on CPU, memory, pages, pixels, output size and wall-clock time. Malformed or malicious files are rejected, not repaired.

Nothing sensitive in logs

Logs and error reports never contain file names, document text, signed links or extracted content. Only job identifiers, tool names and timings are recorded.

Accounts and payments

Sign-in uses Google or a one-time email code; we store no passwords. Payments are handled by Stripe; card details never touch our servers.

Status and disclosure

Merge and split are live; other tools open one by one after their own checks. If you find a security issue, contact the operator listed on the terms page. We answer within two working days and credit reporters who wish to be named.