What Happens When You Upload a File
You drag a contract into a converter box. Two seconds later a download link appears. That quiet simplicity hides the part most people never see. When you use a server-side file conversion tool, your file follows a predictable path:
During that time, the file is accessible to the company's engineers, accessible to the company's cloud provider, captured in server logs, potentially included in analytics and monitoring pipelines, and subject to whatever backup retention policies the hosting provider uses. “We delete files after 24 hours” means the deletion job ran on the primary storage. It says nothing about backup snapshots, logging systems, or CDN caches.
The CDN Layer Most People Never Think About
“CDN caches” in the list above is easy to skim past, but it is worth being specific about what it means. Most file tools that handle any real traffic sit behind a CDN like Cloudflare or CloudFront for performance and DDoS protection. If the processed output is served from a predictable or guessable URL, that file can end up cached at edge nodes around the world, sometimes for hours after the “original” copy on the origin server has been deleted. Cloudflare's own documentation on default cache behavior explains how aggressively static-looking content gets cached by default, which is great for a marketing site and a genuine liability for a tool that is supposed to be handling one-off, sensitive user files. A deletion policy on the origin server does not reach into every edge cache that already has a copy.
Photos carry their own quiet exposure. Most phone cameras stamp GPS coordinates, the camera serial number, and the exact time a shot was taken straight into the file as EXIF metadata. A 2015 study of nearly 100,000 photos found that a meaningful share of freshly taken images still carried geolocation data, and the authors showed how trivial that metadata is to harvest for a real-world attack. Read the University of Delaware metadata privacy study for the numbers. If you strip that metadata before any upload, you remove one of the easiest ways a file can betray where you were. Our image optimization guide covers the practical steps for scrubbing it locally.
What the Terms of Service Actually Say
These are real-style clauses from free file conversion tool Terms of Service — not invented:
Data Ownership Clause
“By uploading files to our service, you grant us a worldwide, royalty-free, non-exclusive, irrevocable license to host, store, reproduce, modify, create derivative works from, and distribute content you submit, post, or display.”
Third-Party Sharing Clause
“We may share document metadata and file contents with third-party service providers to improve our tool performance, provide analytics, and deliver targeted advertising.”
The “Better” Version (Still Risky)
“Files are automatically deleted from our servers within 24 hours of upload. We do not share your files with third parties.”
Sounds safe — but says nothing about server logs, backup systems, or subprocessors.
The GDPR Compliance Problem
Under GDPR, if you are in the EU (or processing data about EU citizens), you are the data controller. When you use a third-party tool to process personal data, that tool becomes a data processor. You must have a signed Data Processing Agreement (DPA) with that processor.
Most free online tools do not offer DPAs. Some do not even have a GDPR-compliant privacy policy. If you upload an HR spreadsheet with employee names and salaries, a contract with client personal details, or a customer list — without a DPA — that may create a serious compliance problem. The exact legal position depends on the data, the parties, and the jurisdictions involved, so treat this as a question for your privacy team rather than a blanket legal conclusion.
Documented risks, not just theory
The concern is not limited to unclear privacy policies. In March 2025, the FBI Denver Field Office reported scams where free converters performed the advertised conversion but returned files containing hidden malware. The warning also says the sites could scrape submitted files for sensitive information.
There is a privacy and reputation risk even when malware is not involved. Schillings describes a case in which a family office's consolidated financial statement was scraped after a staff member uploaded it to a Word-to-PDF converter. The document later appeared as a Google result for the family name. Read the firm's case study for the full account.
Experian gives the practical version of the same advice: avoid uploading personal, financial, or confidential files; check how a service stores and deletes files; and scan downloaded results before opening them. Its guide to the risks of online file and PDF converters is a useful reference for non-technical teams.
How to Tell If a Tool Is Server-Side or Client-Side
Open Chrome DevTools (F12) > Network tab before using the tool. Process a small test file — anything with recognisable content. Watch the Network tab during processing:
| What You See | What It Means |
|---|---|
| Large POST request during file processing | Server-side — file was uploaded |
| Request size matches your file size | File was definitely uploaded |
| No network requests during file processing | Client-side — runs locally |
| Tool still works when you go offline | Definitely client-side |
| Large JS/WASM download when page loads | Likely client-side (processing library) |
Risk Level by File Type
| File Type | Common Sensitive Content | Upload Risk |
|---|---|---|
| PDF contracts, agreements | Names, signatures, financials, legal terms | Very high |
| CSV / Excel spreadsheets | Customer data, employee records, financial data | Very high |
| Photos / images | EXIF GPS data, faces, identifiable locations | Medium–High |
| JSON / YAML config files | API keys, database credentials, secrets | Extremely high |
| Generic product photos | Usually none | Low |
What “Client-Side Processing” Actually Means
A client-side tool loads processing code (JavaScript or WebAssembly) into your browser on page load. When you drop a file, the code runs locally — in the same isolated environment as every other JavaScript on the page.
The file bytes never leave your machine. No network request is made. Your file is not stored anywhere except the browser's memory for the duration of the processing. When you close the tab, the data is gone.
This is the design goal for FileMint's local tools: the file stays in your browser while the selected operation runs. You should still verify the behaviour yourself, because a privacy claim is only useful when it can be tested. A tool that processes a PDF on your machine also sidesteps the whole GDPR data-processor question, which our client vs server-side guide breaks down in plain terms. For a technical explanation of how we build this and what the architecture looks like, read our client-side tools technical guide. For why developers specifically prefer this approach, our piece on why developers prefer offline tools covers the latency, privacy, and reliability arguments.
This isn't limited to fake converters
Malicious file tools are only one slice of the problem. In 2023, researchers at Avast uncovered 32 malicious Chrome extensions, installed roughly 75 million times combined, that quietly harvested user data in the background — a reminder that the browser add-on you installed for “PDF tools” can be just as dangerous as the upload site you were trying to avoid. Malwarebytes' analysis of the same converter-malware wave, and Kaspersky's guidance on converting files safely, both land on the same recommendation as the FBI: prefer built-in OS tools or trusted local software, since your data never has to leave the device in the first place. The FBI's full IC3 public service announcement has more detail than the field-office summary linked above, including how to report an incident if you think you have already been affected.
Three Steps to Safer File Handling
None of this means you must stop using online tools. It means you should know which ones touch your data. The habit takes ten seconds and spares you the conversation you do not want to have with a client or a regulator.
- 1Before uploading any document containing personal data: open DevTools, check the Network tab during processing. If you see an upload request, stop and find a client-side alternative.
- 2Read the Terms of Service of any tool you use repeatedly for business files. Specifically search for “license”, “store”, and “share” — those are the clauses that matter.
- 3Use client-side alternatives for any file operation that does not strictly require a server (compression, conversion, merging, hashing, formatting). The browser can handle most common file operations without an upload.
How to Verify FileMint's Client-Side Isolation Manually
To prove that your document data never hits an external cloud stack, execute this 60-second audit:
- Open your browser console by pressing F12 (or Right-Click -> Inspect Element).
- Click directly on the Network Tab.
- Toggle the throttle selector to Offline Mode (completely severing your internet connection).
- Drag a sample payload into our PDF Compressor Tool.
- The browser compiles and processes the compression locally via WebAssembly memory frames, completing without an active web socket or server request.
Process files locally — your files never leave your device.
PDF merge, image compression, CSV conversion, hash generation — all run in your browser. Your files stay on your device.
View All Local Tools →