Security

Most tools never send your file anywhere

Merge PDF, Split PDF, Rotate PDF, Reorder Pages, Sign Documents, Watermark PDF, Redact & Edit PDF, most image tools, and the calculators all run entirely inside your browser using JavaScript. Your file is read into memory on your own device, processed there, and the result is written back to a download — it never touches a Convertam server or leaves your computer or phone at any point. This isn't a policy decision that could change; it's how the tool is architected. If you disconnect from the internet after the page loads, most of these tools keep working.

Encryption in transit

Every connection to convertam.app, including every file upload for the tools that do require server-side processing (document format conversions, Compress PDF, OCR, and the AI-assisted tools), is encrypted with HTTPS/TLS. Your browser verifies our certificate before sending anything, and the connection cannot be read in transit by your network, your ISP, or anyone sitting on the same Wi-Fi.

Server-side processing is short-lived and isolated

When a tool does need a server (because browsers can't run a full document-conversion engine or a large AI model), your file is:

• Uploaded over an encrypted connection directly to the processing service (CloudConvert for format conversions, Google Gemini for AI-assisted extraction/analysis/generation).
• Held only for the duration of that specific job — there is no persistent database of uploaded files.
• Deleted immediately once the job completes or fails. See our File Deletion Policy for the exact mechanics per tool.

Payment security

Paid conversions are billed through Paystack, a PCI-DSS Level 1 compliant payment processor regulated by the Central Bank of Nigeria. Card numbers, CVVs, and other payment details are entered directly into Paystack's own hosted checkout — Convertam's servers never receive, see, transmit, or store your card details. We only receive a payment reference confirming the transaction succeeded.

Infrastructure

Convertam is hosted on Vercel, which provides DDoS mitigation, automatic TLS certificate management, and infrastructure isolation between deployments. Application code is deployed from a version-controlled repository — there is no direct manual editing of the live server.

Account security

Convertam has no user accounts, no passwords, and no login system for regular use of the tools — which means there is no password database to be breached, and no account to be taken over. The only credential-based access on the site is a separate, restricted owner-only admin function unrelated to normal tool usage.

Reporting a vulnerability

If you believe you've found a genuine security vulnerability — not a general bug report — please email okekechris24@yahoo.com with a clear description and, if possible, steps to reproduce it. Please don't test for vulnerabilities against other users' data, and give us a reasonable window to fix an issue before disclosing it publicly. Convertam is an independently run project, so responses may not be instant, but every genuine report is read and taken seriously.