Security
You're trusting us with files you can't put just anywhere. Here's exactly how we handle that trust, end to end.
In transit
Public uploads and downloads are designed for HTTPS/TLS. Configure TLS termination on your reverse proxy or CDN in production — local development may use plain HTTP to MinIO.
At rest
Files live in an S3-compatible bucket under isolated per-user, per-job keys. Production enables AES-256 server-side encryption (SSE-S3) on every put when `CONVYX_REQUIRE_S3_CREDS=1` (or `S3_SERVER_SIDE_ENCRYPTION=AES256`).
Retention & deletion
You choose retention at upload: delete after a five-minute immediate-download grace period, after 1 hour, after 24 hours, or after 7 days, subject to plan limits. The countdown starts at completion. A scheduled job hard-deletes expired objects from storage, not just database references.
Access control
Download links are signed and expire. Only the account that created a job can access it. API keys are scoped (convert:write / jobs:read) and hashed at rest — we never store a key in plaintext.
Isolation
Separate image, spreadsheet, PDF, office, media, and archive queues run with bounded per-engine concurrency and timeouts. Per-user fair-share limits prevent one account from consuming every worker slot. Objects are namespaced per user and job so results cannot be listed across accounts via the API.
Compliance
We operate on GDPR-aligned data handling and offer a Data Processing Addendum on request. A SOC 2 Type II audit is planned; we will update this page when an engagement is formally underway.
Vulnerability disclosure
Found a problem? Email [email protected] with the affected route or component, impact, and reproduction steps. Do not access other users' data, degrade the service, or include sensitive files in the initial report.