Trust · Transparency

Security & Privacy

Every design choice here optimises for privacy. Your files never leave your device — and nothing about you is shared with third parties beyond anonymous analytics.

100% Browser-Based File Processing

Every PDF, image, spreadsheet and 3D-model conversion runs entirely in your browser using WebAssembly and native browser APIs (pdf.js, pdf-lib, docx, SheetJS, Canvas). No file is ever uploaded to a server. Close the tab and the file is gone.

HTTPS-Only with HSTS

All traffic is served over TLS 1.3 with HSTS (Strict-Transport-Security) enforced by our CDN. HTTP requests are rejected. Certificates auto-renew every 60 days.

Strict Content Security Policy

A strict CSP restricts which scripts, styles, images and connections are permitted. Third-party scripts are limited to a small allowlist (Google Analytics, AdSense, Emergent CDN). Inline scripts require CSP-hash approval.

No Tracking, No Auth Cookies

We store zero PII. No login cookies, no advertising cookies, no fingerprinting. Only anonymous Google Analytics 4 pageviews (respects Do Not Track). Your local drafts (Resume Builder autosave, promo dismissals) stay in your browser's localStorage — never sent anywhere.

Battle-Tested Open Source Libraries

We use the same open-source libraries trusted by production teams worldwide: pdf.js (Mozilla), pdf-lib, docx, SheetJS, jspdf, Recharts. Patched to the latest security-audited versions.

Passed 5 Security Audits

The full app was audited end-to-end 5 times before public launch — including rate-limiting on AI endpoints, TTL indexes on Mongo collections, payload size caps, and a swap from vulnerable xlsx to the community-patched @e965/xlsx. Zero open findings.

AI features · when data leaves your device

The only 3 tools that send data to a server

These 3 tools use the Emergent LLM key (Gemini 3 Flash) to generate content. Your input is sent to Google's inference API, processed, and the response returned. Nothing is stored server-side.

Language Translator
Sends only what you type. No auth, no PII.
Resume Builder AI-Polish
Sends only what you type. No auth, no PII.
Baby Name Suggester
Sends only what you type. No auth, no PII.

Report a security issue

Found a vulnerability? Please report it responsibly to security@converterpro.co.in. Please give us 90 days to remediate before public disclosure. All of the app's 111 tools are open to responsible testing.