Security & Data Protection

Last Updated: 20 February 2026

Your files are protected at every step of the conversion process.

Encrypted File Transfers (HTTPS / TLS 1.3)

Every file you upload or download is protected with TLS 1.3 encryption — the latest security standard. Your data cannot be intercepted or read during transfer.

Our security configuration is rated A+ by Qualys SSL Labs, an independent web security testing service.

File Storage & Retention

All uploaded and converted files are encrypted at rest using AES-256 — the same standard used by banks and government agencies.

Automatic Deletion

Both your uploaded file and the converted result are automatically deleted after 24 hours
No files are retained beyond this period without your action

Retention Control for Paid Users

Paid plan users have additional control:

Set auto-delete to 15 minutes after conversion
Delete files immediately on demand from the conversion page or dashboard

Infrastructure & Data Location

Conversion Tools operates across three regions on ISO 27001 certified data centers: Germany, United States, and Singapore. Core data (database) is stored in Germany (EU).

Additional security measures in place:

24/7 monitoring and intrusion detection
Firewalls and strict access controls
Encrypted backups
Regular security audits

In the unlikely event of a security incident, we follow GDPR breach notification protocols (within 72 hours as required by Article 33).

Access & Privacy

Your files are processed by automated systems only — no employee can read or inspect your file contents
File access is restricted to the conversion process and your own download
Files are never used for training, analytics, or any purpose beyond conversion

GDPR & Data Processing Agreement

Our data handling practices are GDPR-compliant (Articles 32 and 33).

For organizations with compliance requirements, we offer a Data Processing Agreement (DPA). Contact us at our contact page to request one.

Third-Party Services

We use analytics and advertising partners (Google Analytics, Google AdSense, Ezoic, PostHog). These services never have access to your uploaded files or their contents — only anonymized usage data (page visits, browser type) is shared. See our Privacy Policy for full details.

On-Premise & Private Deployment

For organizations with strict data residency or compliance requirements, we offer private deployment options — including deployment within your own infrastructure or cloud account.Contact us to discuss your requirements.

Security Contact

If you have questions about our security practices, need to report a vulnerability, or want to request a DPA, please contact us. We respond to all security inquiries promptly.

For more information see our Privacy Policy and Terms of Use.