Security

The strongest security statement we can make is architectural: your files never leave your device. There is no upload endpoint, no processing server, and no file storage anywhere in ConvertUno — so the most common risks of online converters (interception in transit, retention on servers, breach of stored files) simply do not apply here.

How conversion works without a server

ConvertUno uses the media engines built into your browser (WebCodecs, with a WebAssembly fallback for older formats). The website you download from us is static code; once loaded, it reads your file locally, processes it locally, and writes the result locally. You can watch the network panel of your browser while converting — no request carries your file.

Hardening on the site itself

• All traffic is HTTPS with HSTS; the site is served from Cloudflare's edge network.
• A strict Content Security Policy limits what code can run on each page.
• Standard protections are enabled: nosniff, frame-ancestors denial (no clickjacking), referrer policy, cross-origin protection headers.
• Dependencies are locked to exact versions with a lockfile, and every release is tested and audited before deployment.

What we can't see

Because processing is local, we cannot see your files, their names, their contents, or their results — even if we wanted to, even under request. The only data that exists is the anonymous website analytics described in theprivacy policy.

Reporting a vulnerability

If you believe you've found a security issue, please email[email protected]. We take reports seriously and respond quickly.