OmniConvert

Security

The safest file is one that is never stored. OmniConvert is built to keep as little as possible: no accounts, no file storage, no file contents in logs. Here is exactly how it works.

Your files

  • Files are uploaded over HTTPS (TLS) and converted in server memory.
  • They are never written to disk, saved in a database, or kept after the conversion. The result goes straight back to your browser.
  • File names never appear in our logs or analytics, and neither do file contents, with one exception: when a conversion fails, the error message we record can quote a short part of the input.
  • Uploads are limited to 50 MB.

No accounts, no passwords

  • There are no accounts to break into. Credits are tied to a random token (a version 4 UUID with 122 random bits) that only you receive.
  • The token is removed from the page address as soon as it is saved in your browser, so it doesn't end up in browser history, analytics or links you share.
  • Our database accepts no direct connections from browsers; only our server can read or write it.

Payments

  • Payments run on Stripe Checkout. Card details are entered on Stripe's page and never reach our servers.
  • Payment notifications from Stripe are verified by their signature before credits are issued.

Sensitive formats

  • Certificate and key conversions accept public data only. Private keys are refused: never upload a private key to any online tool.
  • For confidential documents, remember that every online converter, this one included, sees the file while converting it.

What we do keep

A count of free conversions per day stored against a hash of your IP address, anonymous usage statistics, purchase records, and our hosting provider's request logs. The Privacy Policy lists every item, why we keep it and for how long.

Infrastructure

  • Hosting: Railway, EU West region (Amsterdam, Netherlands), where files are converted. Database: Google Firebase Firestore. Payments: Stripe.
  • Browsers are told to always use HTTPS (HSTS), and the site cannot be embedded in other sites' frames.

We are a small company and hold no certifications such as ISO 27001. What we can promise is to keep as little of your data as possible and to be specific about what we keep.

Report a vulnerability

Found a security problem? Email info@coastsolutions.ee with the details. We will reply, fix confirmed issues as fast as we can, and credit you if you like. Please give us a reasonable time to fix an issue before publishing it. Our contact is also in security.txt.