Is it safe to convert files online?

The honest answer

Yes — *if* the converter you pick gets four things right. Most don't.

Here are the questions you should be able to answer before uploading anything sensitive:

1. Where are the files physically stored?

A file uploaded to a converter site ends up on a server somewhere. That somewhere matters. For EU residents in particular, files processed in the US are subject to the Cloud Act — US authorities can compel the provider to hand them over regardless of where the user lives. Files processed in the EU are subject to GDPR, which has stricter protections.

Almost no converter tells you this directly on the home page. Look for it in the privacy policy under "data residency" or "where we host". If you can't find it: assume US.

2. How long do they keep the file?

The healthy default is "until the job finishes, plus a short window for the user to download." Anything longer means the file is sitting on their disk being backed up, possibly indexed, and possibly retained beyond the deletion claim if subpoenaed.

Concrete benchmarks:

• 1 hour: short but not unreasonable
• 24 hours: standard for "download links that work after you close the tab"
• 7 days or more: not great
• "Retained for product improvement": means they may use your file to train internal tooling — usually not what you want

3. Do they read the file contents?

Read the privacy policy for any phrase like "we may analyse files to improve the service", "we collect content metadata", or "we may use uploads to train our AI". These are all soft phrasings of "we look at your stuff." A serious privacy-first converter explicitly states it does not.

4. Is the transfer encrypted end-to-end during conversion?

HTTPS to the server is table stakes. The bigger question is whether the file is also encrypted at rest while it sits on the converter's disk. Some are; many aren't. The competitor's docs will mention "encryption at rest" specifically if it exists.

What bulkconvert does

• EU-hosted by default — your files never leave EU jurisdiction.
• 24 hour retention on the signed download URL, after which files are permanently deleted from CloudConvert object storage.
• We never read file contents — no logging of file bodies, no AI training, no human review.
• HTTPS in transit; encryption at rest via the underlying storage provider.

If those four boxes matter to you, bulkconvert is a safe pick. If they don't — say you're converting a meme — almost any converter is fine.

When to be paranoid (and use desktop tools instead)

If the file is genuinely sensitive — legal documents, medical records, financial statements, anything with personal data — the right answer is not to upload it to a third party at all. Use a desktop tool:

• LibreOffice (free, cross-platform) — handles most document conversions
• ffmpeg — handles every audio/video conversion ever
• ImageMagick — handles every image conversion

These run on your machine. Nothing leaves.

bulkconvert is the right tool when the file is "important enough to convert correctly" but not "important enough to install software for". It's not a replacement for proper offline handling of regulated data.