Security is built into Xonvert from the architecture up. The short version: your files never leave your device, your account is protected by modern primitives, and we collect the minimum we can.
1. Your files stay on your device
Every tool runs entirely inside your browser. Conversion, compression, editing, viewing, recording, transcription, translation, OCR, AI cutouts, peer-to-peer file send — all of it. Your file bytes are never transmitted to or stored by Xonvert, and never used to train any model.
Live features (calls, watch parties, send) connect directly device-to-device. Only minimal signalling metadata briefly passes through Xonvert so the peers can find each other.
2. Connections are encrypted
Connections to Xonvert are encrypted in transit using current industry-standard transport security. Browsers that have visited Xonvert once will refuse to use the unencrypted version afterwards.
3. Account protection
- Passwords are stored hashed, never in plaintext.
- Repeated failed sign-in attempts are throttled.
- Reset and verification links are single-use and short-lived.
- Sensitive state-changing requests are protected against cross-site forgery.
4. Payments
Card payments are processed by Stripe; cryptocurrency payments by NOWPayments. Full card numbers never reach Xonvert — they go straight to the payment processor. We store only the tokens and metadata needed to issue invoices and renewals.
5. Anti-abuse
Xonvert protects itself against automated abuse, credential stuffing, scraping, and unauthorised copying with a layered set of controls. The free-tier usage meter resists common bypass attempts (cookie clearing, IP rotation) so the fair-use limits apply equally to everyone. Premium tools are gated end-to-end so they only run for legitimate sessions.
6. Data minimisation & retention
We collect the least we can to operate the Service. Usage counts roll off, logs are deleted or anonymised on a short schedule, support correspondence is kept only as long as needed. See the Privacy Policy for the complete schedule.
7. Vendor diligence
We use a small, deliberately-chosen set of subprocessors. Each receives only the minimum data needed for its function and is bound by data-processing terms. The full list, including processing region, is published at subprocessors.
8. Incident response
We monitor for unusual access and unusual error rates. If a personal-data breach occurs and is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected users directly without undue delay — with what we know about scope, impact, and the steps we're taking.
9. Responsible disclosure
If you have found a security issue, please tell us before disclosing publicly. Reach out through support with “security” in the subject; we acknowledge within 72 hours and work with you on a fix.
- Please don't access more data than necessary to demonstrate the issue.
- Please don't run automated scanners against the production site.
- Please don't use social engineering against staff or other users.
We don't currently operate a paid bug bounty, but we credit researchers in release notes (with your permission) and we make targeted rewards for high-impact reports.
10. Changes
As the Service evolves, this page evolves with it. The “Last updated” date reflects the most recent change.