Security

Updated: 2026-09-23

In one line

There is no upload. The code that reads and converts your files runs inside your browser. It is not that we choose not to send them — there is no code that could. We have nowhere to store your files and nothing to delete.

Check it yourself (30 seconds)

Rather than asking for trust, here is how to verify.
① Go offline. Open a tool page, turn off Wi-Fi, then drop a file in. It still works; anything server-based would stop here.
② Open DevTools → Network and drop a file in. No request carries your file.
③ This site serves static files only, so no upload endpoint exists to receive one.

Why it matters

Report cards, contracts, ID scans and official letters uploaded to a conversion site end up on someone else's server, with no way for you to check the retention period, who can read them, or whether they leaked. Keepdesk removes the risk itself: not by guarding your files well, but by never holding them.

What is stored

No files at all. A few tools (character counter, text cleaner, text compare, JSON formatter) keep your last input in your browser's own storage (localStorage) for convenience. It is never transmitted and can be cleared through your browser's site-data settings. See the privacy policy for details.

Access logs

Serving a website means the host (Cloudflare) records standard access logs: IP address, browser type, time and requested path. Every website does this, and it has nothing to do with file contents. We do not use these logs to identify individuals.

Security policies applied to every page

Rules the browser enforces, actually switched on here.
· Content Security Policy: scripts, images and connections are restricted to our own domain. Third-party scripts cannot slip in, and inline scripts are not allowed.
· connect-src restriction: the browser itself blocks the page from sending data anywhere else.
· HTTPS enforced and frame-ancestors 'none': no interception in transit, and no other site can frame our pages to trick you.
· No tracking scripts: no third-party ad or analytics trackers.

Limits, stated plainly

· If the browser itself is compromised or carries a malicious extension, no website is safe.
· Once you upload the result somewhere, that service's policy applies.
· Redaction and watermarks apply to the newly saved file only; sending the original alongside defeats them.
· HWP and PDF rendering uses open-source implementations and may differ from the original. Check important documents against the source.

Found a problem?

If you believe you have found a security issue, please write to help@keepdesk.app and give us time to fix it before disclosure. Every open-source component and licence we use is listed on the open source page.