Security

Files are processed on your device

Every tool runs in your browser. The file bytes are never transmitted, so there is no upload to intercept, no server-side copy to breach, and no retention window to get wrong. This is a property of where the code runs rather than a policy we are asking you to trust.

It also bounds the impact of any compromise of our infrastructure. An attacker who took our web servers would gain the ability to serve you different JavaScript; they would not gain a store of anyone documents, because that store does not exist.

Input is validated before anything parses it

File type is determined by reading the bytes, never by trusting the extension or the MIME type your browser reports. Both of those are attacker-controlled, and a file named .pdf that is something else entirely is the oldest trick in this category.

Before a file reaches an engine we also read its header — within a hard byte cap — to establish page count and image dimensions, and reject anything beyond the limits. Byte size alone is not a safe measure: a 4 MB PDF can contain half a million pages, and a 40 KB PNG can decode to gigabytes of bitmap. Both pass a size check and then exhaust the machine.

These checks run in two places that do not trust each other: in your browser, and again beside the engine.

Engines and the supply chain

Processing engines are served from our own origin rather than a third-party CDN, with Subresource Integrity hashes recorded against each version. Serving executable code from someone else infrastructure into pages that handle legal documents is a risk we are not willing to take for a marginal caching benefit that browsers no longer provide anyway.

Engine licences are checked in the build. A build that binds a tool to an engine whose licence has not been approved fails rather than shipping.

What we do not claim

Client-side processing protects your files from us. It does not protect them from your own device: malware on your machine, or a compromised browser extension with permission to read page content, can see anything you open here, exactly as it can see anything you open anywhere else.

A watermark is a statement of intent, not a security control. A password removed from a PDF you own is removed for anyone who then receives that file.

Reporting a vulnerability

Write to security@tools-verse.com. Please give us a reasonable period to fix an issue before disclosing it publicly. We will confirm receipt, keep you updated on the fix, and credit you if you would like to be credited.

We are particularly interested in anything that would cause a file to leave a user device, anything that defeats the input validation described above, and anything that would let one page influence what another page executes.