Everything between your browser and the server travels over HTTPS. Nothing in between can read the contents.
Every file and job carries a company id, and every query filters on it. There is no path from one company's data to another's.
Jobs execute in separate processes and their temporary directories are removed when the job ends.
Free plan files are removed after 24 hours; Team and above keep them for the period the company chooses.
Each link can carry an expiry and a maximum number of downloads.
Administrators can see who touched which file and when.
You give a URL and the server fetches it. Private ranges (10/172.16/192.168), link-local (169.254), loopback and cloud metadata endpoints are all refused. So are octal, hex and shortened forms (0177.0.0.1, 0x7f000001, 127.1) and IPv4-mapped IPv6 — they resolve to the same place and are treated as such.
The hostname is resolved and the address checked, and the connection is made to that address directly. There is no window between checking and connecting for DNS rebinding to exploit. HTTPS connects by IP but validates the certificate against the original hostname.
A public URL that forwards to an internal one gets no further: each hop is re-checked. At most five hops are followed, and credentials are dropped when the host changes.
file, gopher, ftp and the rest are not accepted, and ports are limited to an allow-list so the fetcher cannot be used to probe internal services.
Declared sizes and entry counts are checked before extraction, and actual bytes are counted during it. Crossing the limit stops the job there — a few megabytes cannot become gigabytes on our disk.
A file named .jpg that is really an executable is rejected by the tool that opens it. Nothing is processed on the strength of its name.
Each conversion runs in its own process, under a time and memory limit, in a temporary directory of its own that is deleted when the job ends. A tool that crashes fails that one job and nothing else.
Downloads are served from a different domain than the app, always as an attachment. An HTML file someone uploads cannot run in the app's origin or reach anyone's session.
A failed conversion tells you what was wrong with the file. Which tool ran with which arguments stays in the administrator's log.
If you need more for a security review, or you have found a vulnerability, write to [email protected] and we will get back to you.