How We Protect Your Files
At AllFreeConvert.com, keeping your files safe is just as important as converting them. Here is exactly how we protect your files, your account and your payments — no buzzwords, just the measures we actually use.
Technology
HTTPS / TLS encryption
Everything sent between your device and our servers is encrypted with modern TLS (HTTPS). HSTS tells your browser to always use a secure connection, so your files can't be read or changed on the way.
Cloudflare protection
All traffic passes through Cloudflare's global network, which filters out attacks such as DDoS floods and limits abusive request rates before they ever reach our server.
No open server ports
Our server connects outward through an encrypted Cloudflare Tunnel instead of accepting connections from the internet. There is no public address for attackers to reach it directly.
Private job folders
Every conversion runs in its own folder with a long, random ID. Download links can't be guessed, and no one else can see or download your files.
Automatic deletion
Your original upload is deleted as soon as the conversion finishes. Converted files are removed automatically after 8 hours (12 hours on Standard, 24 hours on Pro). We don't keep copies.
Browser-only tools
The PDF editor, e-sign, PDF reader, color picker, unit converter and time converter run entirely in your browser. Files you open in them never leave your device.
Practices
Secure accounts
Passwords are stored only as strong one-way hashes, never as readable text. Password reset links work once and expire after 60 minutes.
Bot and spam protection
Log in, sign up and password reset are protected by Google reCAPTCHA, which stops bots from creating fake accounts or guessing passwords. Password reset emails are limited to a few per hour.
Protected forms
Account, payment and admin forms carry a secret security token, which blocks cross-site request forgery: other websites can't submit those forms in your name.
Payments we never see
Paid plans are paid through Dodo Payments, our merchant of record (or PayPal for older subscriptions). Your card details go directly to them — we never see or store them.
Privacy first
We don't look at the contents of your files and we never sell personal data. Visitors in Europe, the UK and Switzerland choose whether to allow ad and analytics cookies.
Report a problem
Found a security issue? Email us at [email protected] with the details. We take every report seriously and respond promptly.
Questions about your data?
Read our Privacy Policy for the full details of what we collect and why, or contact us — we're happy to help.