Security

Private by default. Closed when unsure.

AI Converter is designed for files you would not put in a shared inbox: private storage, tokened job access, short source retention, abuse limits, and low-confidence failures instead of human file review.

No public object URLs for uploaded or generated files.

Storage

Files stay private.

Uploaded files and generated files are stored in private object storage.
Files are not exposed through public object URLs.
Job access requires a job ID and random token.
API responses are marked no-store so browsers and intermediaries should not cache sensitive responses.

Processing

The route depends on the file and selected output.

Digital bank statement PDFs use the native parser first. OCR fallback is reserved for scanned, photo-based, receipt, invoice, screenshot, or messy files when configured. Audio transcript, document Markdown, screenshot-to-HTML, and common file-format conversion run only when the selected conversion is available. Low-confidence AI extraction files fail closed instead of being routed to human file review.

Subprocessors

The processor list is intentionally explicit.

Cloudflare runs hosting, Workers, private storage, database, Turnstile, and some AI routes. Mistral may process OCR or document understanding jobs. CloudConvert and Convertio may process provider-backed file-format conversions. Dodo handles checkout and card processing.

AI Converter does not use uploaded files or generated outputs to train models. Do not upload files unless you are comfortable with the selected route using the processor needed to complete that conversion.

Retention

Source files do not stay around.

Source files are deleted after failed preview, failed full extraction, completed redo, or the 24-hour private source lifecycle.
Generated files expire after 7 days.
Minimal job metadata is kept for payment, abuse prevention, debugging, and compliance records.

Abuse prevention

Guardrails are built into the flow.

Server-side file validation and PDF page estimation.
Upload rate limits by hashed connection data.
Same-file free preview limits.
One automatic stronger redo per paid job.
Unique payment binding to prevent payment reuse.

Limits

Security does not mean every file works.

AI Converter currently accepts files up to 50 MB, audio-transcript files up to 25 MB, and PDFs up to 500 pages. Password-protected, corrupted, unusual, noisy, unsupported format pairs, or low-quality files may fail. The export should always be reviewed before important use.

Report

Send a short security report.

Use the support form with a short description. Do not include full bank statement, receipt, screenshot, or source-file details in support messages.

Use the preview as your quality gate.

AI Converter is built around a simple rule: inspect the sample before trusting the full export. That matters for bank statements, receipts, invoices, screenshots, and other sensitive files because automated extraction can be wrong when a scan is noisy, a table is unusual, a file is damaged, or a provider cannot safely read the source. The preview gives you an early look at columns, dates, descriptions, totals, signs, and row structure before you pay for the complete result.

For accounting workflows, compare the export with the source statement before importing it into bookkeeping, tax, lending, or compliance systems. Keep the privacy pages close too: source files are handled for the job you start, generated files have a short download window, and support requests should use job IDs rather than pasted bank, receipt, invoice, screenshot, or document contents.

A clean export is only useful when the route matches the file. Choose the most specific output available, keep the original file until you have checked the result, and use the validation notes or row preview to spot missing dates, duplicate transactions, weak OCR, wrong signs, or totals that do not reconcile. If the preview looks off, stop there instead of paying for a full export.