Security

Local processing

Files are processed on your device. Nothing is uploaded, so there is nothing on our servers to leak.

The security shield

Before a file is opened, AllConvertFile inspects its real content and blocks or warns about:

• Programs disguised as documents (fake, double or right-to-left extensions)
• Office macros, auto-run triggers, DDE fields and remote template injection
• PDF JavaScript, launch actions, embedded files and form submission
• Scripts, event handlers and phishing forms inside HTML and SVG
• XML entity attacks (XXE, “billion laughs”) and prototype-pollution JSON
• Zip bombs, path-traversal archives, image decompression bombs
• Hidden payloads appended to images and PDFs (polyglots)
• Spreadsheet formula injection in CSV/XLSX exports

Output files are rebuilt cleanly, so active content from the original is not carried over.

Report a vulnerability

Please contact us with details. We appreciate responsible disclosure.