Security at ChangeThisFile

Client-Side Conversions Never Leave Your Browser

Most image and data conversions run entirely in your browser using the Canvas API and JavaScript conversion libraries. For these routes your file is never uploaded anywhere — we could not see it if we wanted to. Each conversion page tells you which mode applies: pages marked “No upload — files stay on your device” process everything locally.

Server-Side Conversions Are Encrypted in Transit

Video, audio, document, ebook, and archive conversions need real tooling (FFmpeg, LibreOffice, Calibre, 7-Zip), so those files are uploaded over TLS through Cloudflare's edge to our conversion server. While a conversion runs, your file sits under a random temporary name on an isolated volume — never under your original filename.

Files Are Deleted Automatically

Deletion is enforced in code, not by policy document:

• Your uploaded file is deleted the moment the conversion finishes — whether it succeeds or fails.
• The converted output is deleted seconds after it has been streamed back to you.
• If the conversion service restarts for any reason, it wipes its entire temp directory on startup, so nothing lingers.
• Async API jobs are the one exception: inputs and outputs are held in Cloudflare R2 so you can download the result, and are deleted automatically within 24 hours. Download links expire on the same schedule.

The Conversion Backend Is Sandboxed

Converting arbitrary user files is inherently risky — FFmpeg and LibreOffice parse hostile input for a living. Our conversion backend therefore runs inside a hardened systemd sandbox: it operates in its own mount namespace with a read-only view of only its own code, sees an empty filesystem everywhere else on the host, cannot read any other service's data or credentials, cannot gain new privileges, and is capped on memory and CPU so a malicious file cannot take anything else down. If a converter binary were ever compromised by a malformed file, it would find itself in an empty room.

The open-source engines we run — FFmpeg, LibreOffice, Calibre, Ghostscript, 7-Zip — are kept patched via automated OS security updates.

No Ads, No File-Content Analytics

ChangeThisFile carries no advertising and no ad-network code. Our analytics record metadata only — which format pair was converted, file size, duration, success or failure — never the contents of a file. We do not train models on your files, and there is no code path that reads file contents outside the conversion itself.

Where Your Data Lives

Server-side conversions run on a server we operate in a Hetzner data center in Germany (EU). Web traffic and temporary async-job storage go through Cloudflare's global edge network. Payments are handled by Stripe — we never see or store card details. No third-party conversion services are involved: your file is processed by our own server or by your own browser, nothing else. For GDPR questions or data requests, email support@changethisfile.com. Full processing details are in our Data Processing Addendum summary.

What We Don't Have

We would rather be precise than impressive: ChangeThisFile does not currently hold a SOC 2 report or an ISO 27001 certification. What we offer instead is the architecture described above, a signable Data Processing Addendum incorporating the EU Standard Contractual Clauses, and published reliability targets and monitoring. If your security review needs specific answers, email support@changethisfile.com — we answer vendor questionnaires directly.

Reporting a Vulnerability

Found a security issue? Email support@changethisfile.com with the details and steps to reproduce. We read every report and respond quickly.