Last reviewed September 1, 2026
Security & responsible disclosure.
Free PDF Conversion & Tools uses local-first processing and browser-encrypted temporary storage while documenting controls that remain unverified.
Implemented controls
Controls include nonce-based Content Security Policy, background-worker PDF parsing, file and resource limits, authenticated encryption, strong generated passwords, two-phase one-view claims, route and link rate limits, migration-managed storage, verified deletion checks, privacy-safe operational counters, and short retention.
Encrypted-content malware tradeoff
The server cannot scan encrypted content without being able to decrypt the file. The browser checks supported file formats, but this is not a malware guarantee. Keep browsers updated and do not open untrusted output in privileged software.
Signing assurance
Signature requests record consent events, timestamps, pseudonymous actor records, document hashes, and a downloadable evidence record. The service does not independently verify identity, authority, delivery, custody, notarization, witnessing, or qualified-signature status.
Independent assurance status
No independent penetration test, cryptographic audit, SOC 2 examination, accessibility certification, or other external certification has been completed. The safeguards and this disclosure were internally reviewed on September 1, 2026; internal testing does not replace independent assurance or legal review. Personal and regulated records remain prohibited.
Report a vulnerability by email
Begin the subject with [SECURITY]. Include a brief summary, the public page affected, and safe steps to reproduce using synthetic data. Do not send document contents, passwords, keys, secure links, other people’s information, or live exploit payloads.
Open email for security reportYou must send the message in your email app. If it does not open, copy the address into your email service. This page does not submit or store a report, and no automatic receipt is promised.
Responsible testing
Use only your own synthetic files and accounts. Do not access others’ records, disrupt availability, perform load tests without permission, or publicly disclose sensitive findings before coordination. Contact us before testing that could affect other users.
Email is processed by Microsoft/Hotmail and your email provider. Existing website reports are preserved for handling under our retention procedures. If an acknowledgement has not arrived within three business days, follow up by email; urgent issues should be clearly marked in the subject.