Security & Privacy Center

How your files are processed

The test-file generator and fourteen processing tools handle file content in your browser. Two processing tools — Office to PDF and PDF to Office — upload your file to our conversion service. Page assets, analytics and optional cloud imports have their own network requests. See How it works for each processing model and its limitations.

Transport

Every upload to this site travels over HTTPS (TLS). For the two tools that upload a file, that connection is the only path your file takes to reach the conversion server.

Where files are stored, and for how long

The conversion service attempts to delete source files when processing finishes. A result becomes eligible for cleanup after 15 minutes and is deleted by the queue cleanup process, or after its first download. Actual cleanup time depends on that process running. Job records include the original filename and status; completed records are removed at cleanup or download, while failed job records have no verified automatic deletion schedule.

Server location

The public site, the admin panel and the browser-based tools run on Cloudflare's global network (Workers, D1 and KV). The two upload tools' conversion server is separate infrastructure — not Cloudflare Workers — currently hosted in Turkey.

What we log

Conversion jobs store a job ID, original filename, paths, status and any error message. Server error logs contain job IDs and exception messages, which may include technical paths or filenames. Hosting requests and Google Analytics also produce metadata. File content is not included in our custom usage events; exact hosting log retention has not been verified.

Rate limiting

Not currently applied to the file-processing tools — a maximum file size is enforced instead. We're aware this is a gap for a production security posture and it's on our roadmap.

Malicious file scanning

Not currently performed. Uploaded files are handed directly to the document conversion engine; there's no separate antivirus or malware scan step today.

External services

Cloudflare hosts the site, and a separate hosting provider runs document conversion. Pages load Google Analytics. If you choose Google Drive or Dropbox import, the browser contacts that provider directly to retrieve your selected file. See Privacy for the data flows.

Reporting a security issue

Found a vulnerability or a way this policy doesn't match what actually happens? Email security@byterivet.com — we'll acknowledge it and follow up. A machine-readable version of this contact is also published at /.well-known/security.txt per RFC 9116.

Last updated: 2026-10-14