Security & Data Handling

Encryption in Transit

Traffic between your browser and ToolzStack is sent over HTTPS, and the site sends an HTTP Strict Transport Security (HSTS) header so browsers keep using HTTPS. This protects files and account details from being read on the network while they travel to and from our servers. It is transport encryption, not end-to-end encryption: files that are sent to our servers for processing are readable by the server so that it can convert them.

Where Your Files Are Processed

• In your browser: Several image conversions and PDF operations (for example merge, split, rotate, remove pages, and PDF-to-text) can run locally for files under a size limit, so the file is not uploaded.
• On our servers: Conversions that need server software — Office documents, PDF-to-Word, video, audio, compression and file transfer — upload your file to our infrastructure and to cloud object storage.
• Automatic fallback: Files above the local size limit, or on low-powered devices, are handled by the server even for tools that can normally run in the browser.
• Automatic deletion: Uploaded and converted files are removed by a scheduled cleanup job after a short retention window. See the Privacy Policy for the retention period.

Accounts and Web Security Headers

• Passwords: Account passwords are stored as salted bcrypt hashes, never in plain text.
• Sign-in: Email/password and Google sign-in are supported. Sessions use signed tokens.
• Rate limiting: The API applies request rate limits, including on authentication and upload endpoints.
• Browser protections: Responses include a Content Security Policy, X-Frame-Options (DENY), X-Content-Type-Options, a Referrer-Policy and a Permissions-Policy that disables camera, microphone and location by default.

We handle personal data as described in our Privacy Policy and Cookie Policy. You can ask to access or delete your account data through the contact page. We use Google Analytics for usage statistics and Google AdSense to show advertising; both may set cookies, as explained in the Cookie Policy.

ToolzStack has not been independently audited or certified against any compliance framework. If your organisation needs that assurance for sensitive documents, process those files locally with offline software instead.

• Avoid sensitive documents: For contracts, IDs, medical or financial records, prefer tools that run in your browser or desktop software you control.
• Use a strong, unique password for your ToolzStack account and sign out on shared computers.
• Share transfer codes carefully: Anyone who has a file-transfer share code can look up and download that file until it expires.
• Keep your originals: Always keep the source file until you have checked the converted result.

If you believe you have found a security vulnerability, please email support@toolzstack.com with the steps to reproduce it. Please do not access other users' data or disrupt the service while testing. We review reports as they arrive but do not operate a formal bug-bounty programme or guarantee a response time.