Security by architecture
The strongest way to protect user data is to never possess it. Files are processed on your device, so there is nothing on our side to breach.
Minimal attack surface
There is no file-upload endpoint, no server-side processing and no cloud storage of user files. A breach of our servers could not expose your documents, because they are never there.
Input validation before processing
Before any engine runs, your file is checked against its declared format: extension, MIME type and — where the format registry defines one — the file's magic-byte signature. Empty files, oversized files and mismatched types are rejected with clear messages instead of being processed blindly.
Sandboxed processing
All heavy processing runs inside a dedicated Web Worker with no DOM access, on bytes that were transferred to it and released after the job. Engines validate their options strictly, respect cancellation signals, and free their WebAssembly memory when done. Formats that can carry active content (like SVG) are sanitized — scripts and external references are stripped before the file is optimized.
The backend, scoped down
The backend handles authentication, payments and entitlements only. It receives account identifiers and payment state — never file data. Payment webhooks are signature-verified and processed idempotently, and entitlements are enforced server-side rather than trusted from the client.
Honest capability claims
Every tool on this site maps to an implemented and tested operation in a machine-readable capability registry. Formats we cannot support honestly — for licensing or technical reasons — are marked as such and not offered, rather than quietly misprocessed.