Security & Compliance

Yes. ConvertUniverse is GDPR-compliant by design. For client-side processing (PDF merge, compress, split, image tools), files never leave your browser — no personal data is transmitted to any server. For server-side conversions (DOCX, XLSX, PPTX formats), files are transmitted over TLS 1.3 to an isolated processing server, processed, and deleted immediately after the output is delivered. No file content is stored, logged, or used for any secondary purpose. We do not sell or share user data with third parties.

ConvertUniverse is HIPAA-ready for workflows that use client-side processing tools (PDF merge, compress, split, rotate, protect, sign, OCR, and image tools). These tools process files entirely in your browser using WebAssembly — Protected Health Information (PHI) never reaches a ConvertUniverse server. For server-side Office conversions (DOCX, XLSX, PPTX), PHI should not be uploaded without a signed Business Associate Agreement (BAA). Contact support@convertuniverse.com to request a BAA for Enterprise accounts.

All data in transit is encrypted with TLS 1.3. PDF password protection uses AES-256 encryption — the same standard used by financial institutions and government agencies. For server-side processing, files are transmitted over an encrypted HTTPS channel, processed in isolated memory, and never written to disk in unencrypted form. Authentication tokens use JWT with a 1-hour expiry and are stored in httpOnly cookies.

Zero retention. For client-side tools, files are processed entirely in browser memory and cleared when processing completes or the tab is closed — no file data ever reaches our servers. For server-side conversions, files exist temporarily in isolated server memory only for the duration of the conversion (typically 3–5 seconds) and are permanently deleted immediately after the output file is delivered. No backup, log, or copy of file content is stored.

SOC 2 Type II certification is currently in progress for the Enterprise tier (target: Q4 2026). Our infrastructure is hosted on Vercel (frontend) and a dedicated Netcup VPS (backend processing), both of which operate in SOC 2-compliant data centers. Enterprise customers requiring SOC 2 documentation before certification can request our current security controls documentation by contacting support@convertuniverse.com.

It depends on the tool. Client-side tools (PDF merge, split, compress, rotate, protect, unlock, sign, OCR, JPG-to-PDF, PDF-to-JPG, and all image tools) process files entirely in your browser using WebAssembly — files never leave your device. Server-side tools (Word-to-PDF, PDF-to-Word, Excel-to-PDF, PDF-to-Excel, PowerPoint-to-PDF, PDF-to-PowerPoint) require a LibreOffice rendering pipeline on our backend server. The tool page indicates which processing mode applies before you upload.

No. For client-side tools, files never reach our infrastructure — access by employees is architecturally impossible. For server-side conversions, files exist in isolated process memory only during conversion. Our backend processing pipeline has no logging of file content, no persistent storage layer, and no human access interface. The server discards file data immediately after output delivery.

Client-side processing runs entirely in the user's browser — data processing location is the user's own device, in any country. Server-side processing runs on a dedicated server in a German data center (EU jurisdiction), which is GDPR-compliant by default for EU residents. Enterprise customers requiring specific geographic data residency can contact support to discuss custom deployment options.

No. ConvertUniverse does not use uploaded file content for any AI model training, product improvement analytics, or secondary processing. Files processed server-side are used exclusively to produce the requested output and are deleted immediately. We have no mechanism to access or extract content from files processed client-side.

Account deletion permanently removes your profile, saved workflows, usage history, and API keys from our database within 30 days, in compliance with GDPR Article 17 (Right to Erasure). OAuth tokens for connected services (Google Drive, Dropbox) are revoked immediately. To request account deletion, go to Dashboard → Settings → Delete Account, or email support@convertuniverse.com.