Security at CocoConvert
Your files are your business. We've built CocoConvert with security and privacy at the core — from TLS 1.3 encryption to automatic file deletion — so you can convert with confidence.
End-to-End Encryption
All file transfers between your browser and our servers use TLS 1.3 encryption via our global edge network. Your files are never transmitted in plain text, ensuring complete confidentiality during upload and download.
Automatic File Deletion
Uploaded files and converted outputs are automatically and permanently deleted from our servers within 24 hours of conversion. We intentionally do not provide permanent storage — your files exist only for the duration of processing.
Secure Infrastructure
CocoConvert runs on a distributed infrastructure with global edge routing and TLS termination, isolated European compute servers for file processing, and serverless task queuing. Each layer is independently secured with industry best practices.
Data Isolation
Each conversion runs in a separate, isolated sandbox on our compute servers. This means that even the CocoConvert team technically cannot access your files during processing. File data is strictly separated between users.
No Human Access to Files
Your files are processed entirely by automated systems. No CocoConvert employee or contractor can view, access, or read the content of your uploaded files at any point during the conversion pipeline.
File Type Validation
Every uploaded file undergoes strict MIME type and extension validation before processing. Malicious or unsupported files are rejected immediately, protecting both you and our infrastructure from potentially harmful content.
No Third-Party File Sharing
We never share, sell, or provide your files to any third party. Conversion happens entirely within our own infrastructure — your data never leaves our controlled environment except to be delivered back to you.
HTTPS & HSTS Everywhere
Our entire platform is served over HTTPS with HSTS (HTTP Strict Transport Security) headers and HSTS preloading. This prevents man-in-the-middle attacks and ensures your browser always connects securely to cococonvert.com.
Encrypted Storage
All database records are encrypted at rest using AES-256 encryption. Temporary file storage uses server-side encryption at rest. No file content is ever stored in our database — only metadata for quota enforcement.
Regular Security Updates
Our conversion engines, dependencies, and server images are updated on a regular cycle. We monitor for CVEs and apply patches promptly to maintain a hardened environment. Infrastructure is rebuilt frequently to prevent drift.
How We Handle Your Data
During Conversion
When you upload a file, it is transmitted over an encrypted TLS 1.3 connection through our global edge network to our European compute servers. The file is temporarily stored in an isolated sandbox for the duration of the conversion. Once the conversion completes and you download the result, both the original and converted files are queued for immediate deletion.
After Conversion
All files are automatically and permanently purged within 24 hours. Our compute servers process files in isolated sandboxes — once a conversion completes, any residual data is permanently destroyed. We do not back up, archive, or retain user-uploaded files in any form.
Account Data
If you create an account, we store only your name, email address, and authentication provider. Usage statistics (conversion count, minutes used) are recorded for quota enforcement. We never store the content of your files in your account or in our database. You can delete your account and all associated data at any time from your settings.
Payment Data
Payments are handled by Razorpay (for India) and Paddle (Merchant of Record for international users), both PCI-DSS Level 1 compliant. CocoConvert never stores, processes, or has access to your full card numbers, CVV, UPI credentials, or bank account details.
Reporting Vulnerabilities
If you discover a security vulnerability, please report it responsibly by emailing legal@cococonvert.com. We take all reports seriously and will respond within 48 hours.
Ready to convert securely?
Your files stay private. No storage. No sharing. Just fast, secure conversion.
Start Converting