Security Information

At NexFileo, we understand that security is a critical factor when uploading files online. We have designed our backend architecture to protect your data at every step of the conversion pipeline.

1. In-Transit Encryption

All file transfers between your browser and our servers are encrypted using industry-standard SSL/TLS (HTTPS). This prevents third parties from intercepting your documents during upload or download.

2. Isolated Worker Environments

Conversions are executed in isolated processes.

• No Shared Space: Each conversion job is allocated a unique temporary folder. Worker processes are barred from reading database credentials or system secrets.
• Subprocess Safety: Execution commands (e.g. LibreOffice CLI) are run via parameterized API spawns. We do not evaluate commands within shell environments, completely blocking shell injection vectors.

3. Strict Upload Sanitization

Every file is sanitized before processing:

• Filename Sanitization: Dangerous characters and paths (such as directory traversal attempts like `../`) are stripped or replaced immediately.
• Magic-Byte Validation: We do not rely on extensions. The file signature (magic bytes) is checked on upload to verify that the file type matches the expected format, preventing executable uploads renamed as document extensions.
• File Type Blocklist: Binary executables, scripts, and macro-enabled files are rejected on both the frontend and backend.

4. Ephemeral Files

We do not keep files. Once your conversion is complete, the download link remains active for exactly 2 hours to give you time to retrieve your file. A background cron job runs automatically every hour to delete expired input and output files permanently.