Security at ConvertIntoMP4
Your files are encrypted in transit, processed in isolation, scanned for malware, and permanently deleted within 2 hours. No human ever sees your data.
2M+
Files Converted
268
Formats Supported
13
Open-Source Engines
2h
Auto-Delete
How We Handle Your Files
Every file follows the same secure pipeline. No exceptions.
Upload
256-bit TLS encryption
Scan
Virus check
Convert
Isolated process, no file mixing
Deliver
HMAC-signed download URL
Auto-Delete
Wiped within 2 hours
File Handling
We treat every file as sensitive by default. Our file lifecycle is designed so that nothing persists longer than absolutely necessary:
- Input files are deleted from our servers immediately after conversion completes
- Output files are stored temporarily in encrypted object storage and automatically purged within 2 hours for guest conversions (signed-in files follow your plan's retention — up to 1, 7 or 30 days)
- Users can manually delete converted files at any time before the retention window expires
- No backups of user files are ever created — deletion is permanent and irreversible
- Conversion metadata (job ID, format, status) is kept in a cache that expires after 24 hours and is then purged
Encryption
All data in transit between your browser and our servers is encrypted using industry-standard protocols:
- 256-bit TLS/SSL encryption on every connection — uploads, downloads, API calls, and webhooks
- HSTS (HTTP Strict Transport Security) enabled with a 2-year max-age and preload directive — browsers are forced to use HTTPS
- TLS 1.3 supported at our CDN edge for the fastest, most secure handshake
- Download links use HMAC-signed URLs with expiration timestamps — they cannot be guessed or reused
Data Isolation
Every conversion runs in its own isolated process to prevent cross-contamination between users:
- Each conversion job runs as an isolated process with its own temporary directory
- Files are bound to the user's session — no other user or process can access them
- Document renderer instances run with unique profile paths to prevent state leakage between concurrent conversions
- Temporary files are cleaned by a disk janitor process that removes orphaned files every 5-30 minutes
Infrastructure
Our infrastructure is hosted entirely in the European Union with enterprise-grade providers:
- Dedicated server in Helsinki, Finland (EU). Your data never leaves EU jurisdiction during processing
- Global CDN provides edge caching, DDoS protection, and WAF (Web Application Firewall) rules
- Encrypted object storage for temporary file storage, EU-compliant
- Database and cache run on the same server, so no data crosses another network
- Docker containerized deployment with health checks on all services
Compliance
ConvertIntoMP4 is built with privacy-by-design principles and complies with major data protection regulations:
- GDPR compliant — we process the minimum data necessary, honor all data subject rights, and provide full transparency
- Data Processing Agreement (DPA) available for business customers upon request
- Privacy by design — files are auto-deleted, no human reviews content, no data is used for training
- Maximum 2-hour retention for all user files — no long-term storage of conversion data
- CCPA compliant — California residents can request data access and deletion
- See our GDPR, Privacy Policy, and DPA pages for full details
Authentication Security
If you create an account, we protect it with multiple layers of security:
- Two-factor authentication (2FA) via TOTP — compatible with Google Authenticator, Authy, and other authenticator apps
- Passwords hashed with bcrypt — we never store plaintext passwords
- Session management with secure, HttpOnly cookies and CSRF double-submit protection
- OAuth sign-in via Google and GitHub — no password needed, tokens stored server-side only
- Login attempt rate limiting and suspicious activity detection
API Security
Our REST API is protected with multiple security layers for developers and integrations:
- API key authentication with hashed storage — keys are shown once at creation and never stored in plaintext
- HMAC-signed webhooks — every webhook delivery includes a cryptographic signature you can verify
- Rate limiting — 60 requests per minute per API key with
X-RateLimit-*headers - CORS protection — cross-origin requests restricted to authorized domains
- Input validation via Zod schemas on every endpoint — malformed requests are rejected before processing
Virus Scanning
Every uploaded file is scanned for malware before conversion begins:
- Antivirus scans all uploads in real time before they enter the conversion pipeline
- Infected files are immediately rejected and deleted — they are never processed or stored
- Virus definitions are updated automatically to protect against the latest threats
- ZIP bomb detection prevents decompression attacks from overloading the system
Open-Source Engines
All 13 of our conversion engines are open-source software, publicly auditable, and trusted by millions. Together they cover:
- Video and audio conversion
- High-performance image processing, with a fallback for rare image formats
- Document conversion (PDF, DOCX, XLSX, PPTX)
- Markdown and markup conversion
- eBook format conversion
- PDF compression and processing
- PDF operations (merge, split, rotate)
- Image-to-SVG vectorization
- Website-to-PDF and PNG capture
- Font format conversion
- Archive compression and extraction
No proprietary, closed-source, or third-party conversion APIs are used. Your files never leave our server during processing.
Questions?
If you have security concerns or want to report a vulnerability, contact us at security@convertintomp4.com. We take every report seriously and will respond within 48 hours.