ConvertXLab implements robust technical and administrative security measures to protect website operations and user data.
1. Encryption and Network Controls
All web traffic and API calls are forced over HTTPS using TLS 1.3 encryption. Communication between our Node.js proxy server and the Python conversion service is protected using internal key checks (INTERNAL_API_KEY hash comparison) and restricted to localhost routing.
2. API Security and Hardening
We protect our API keys and database endpoints using several middleware guards:
CORS Origins Allowlist: Restricts API connections to default apex domains and local developer environments.
Rate Limiters: Employs 'express-rate-limit' on the Express API proxy (400 requests per 15 min window) and SlowAPI rate limits on the Python FastAPI service (120 convert calls per minute per IP).
SVG Sanitization & Block: The Python engine automatically drops SVG files at the endpoint validation layer to prevent script execution risks.
3. Database Isolation
We store only metadata and login settings in MongoDB. No actual user file content is stored or cached inside databases. Diagnostic routes are disabled by default.
In addition to the specific items described above, you agree that this document governs all related aspects of our platform, user interface, backend converters, and connected third-party integrations. This document represents a complete understanding between the parties.
We reserve the right to modify these terms, conditions, and descriptions at our sole discretion. Any changes will be posted on this page and the Last Updated date will be revised accordingly. Your continued use of the platform after updates indicates your consent to the changes.
If any provision of this document is found by a court of competent jurisdiction to be invalid, the parties agree that the court should endeavor to give effect to the parties' intentions as reflected in the provision, and the other provisions of the document remain in full force and effect.
Please be aware that our technical infrastructure processes requests using automated filters. Any automated attempt to reverse-engineer our converters, perform unauthorized security probing, or extract metadata from our platform components without authorization will result in immediate IP banning and access revocation.
For any questions, concerns, or requests regarding this document, please contact our legal desk via email at [email protected].
Furthermore, our organization regularly reviews this document to ensure alignment with changes in data protection legislation. In addition to technical safeguards, we provide training to our developers regarding security best practices and secure coding principles. We seek to protect our platform integrity by proactively resolving errors, deallocating unused memory profiles, and minimizing the logging of external identifiers. By accessing the conversion tools on our site, you confirm that you appreciate this framework and support our efforts to maintain a safe, clean, and private platform. We thank you for choosing ConvertXLab.
We are committed to operating in a manner that respects all regional regulations. We maintain strict separation of concerns within our backend architecture. This ensures that user sessions, API validation hooks, and file streams are processed under isolated scopes. We do not engage in any background user tracking or profile merging. We believe in providing a clear, simple, and reliable utility for our global user base.