Your files are safe with Novitora
Security is built into every file conversion. We encrypt your files in transit and at rest, store them in the EU, and delete them automatically 2 hours after upload.
- TLS 1.3 Encryption
- AES-256 at Rest
- SOC 2-aligned
- GDPR Compliant
- Auto-deletion
What happens to a file
One upload, five steps, and then nothing left. This is every place your file exists while Novitora has it.
- t+0s
Encrypted upload over TLS
The file leaves your browser over an encrypted connection. Nothing about it crosses the network in the clear.
- t+1s
Bot check
Cloudflare Turnstile checks that the request came from a person, not a scraper. No account, no captcha to solve.
- t+2s
Queued job in Frankfurt
The job is queued in Frankfurt and runs automatically. Nobody opens the file.
- t+9s
Private download link
The output is stored encrypted and handed back on a download link only you receive.
- t+2h
Deleted 2 hours after upload
The file you sent is deleted, along with the converted output. You do not have to ask, and deleted files cannot be recovered.
The times between upload and download depend on the file. The two-hour deletion is the fixed one.
How we protect your files
Multiple layers of security at every stage of the conversion process
Encryption in transit
All file transfers use TLS 1.3 encryption, ensuring your data is protected during upload and download.
Technical Details
- TLS 1.3 with perfect forward secrecy
- TLS on every connection, including direct uploads to storage
- HSTS enforcement across all endpoints
- Automatic protocol upgrade from HTTP to HTTPS
Encryption at rest
Files stored on our servers are encrypted using AES-256, the same standard used by governments worldwide.
Technical Details
- AES-256-GCM encryption for all stored files
- Unique encryption keys per file
- Keys managed via Google Cloud KMS with automatic rotation
- Encrypted backups with separate key hierarchy
Automatic file deletion
Two hours after upload the file you sent and the file we made are both gone. No setting to remember and no request to send.
Technical Details
- Files deleted automatically 2 hours after upload
- Deletion happens automatically, with no action needed from you
- Deleted files cannot be recovered afterward
- Deletion verified via automated audit logs
No routine human access
Files are processed automatically. Our team does not view your file contents in the normal course of a conversion.
Technical Details
- Automated processing pipeline
- Staff do not read your file contents during a conversion
- Automated processing with no manual intervention
- Access to systems is logged and reviewed
Privacy by design
Privacy is the foundation of everything we build
GDPR Compliant
Full compliance with EU General Data Protection Regulation.
CCPA Compliant
California Consumer Privacy Act compliance for US users.
Privacy-first architecture
Privacy is built into every system from the ground up.
No data mining
We never analyze, mine, or monetize your file contents.
No AI training on your data
Your files are never used to train machine learning models.
Never sold
File contents are never sold or used for advertising.
No ads
We don't show advertisements.
Transparent logging
All access and processing is logged and auditable.
Where your data lives
Our servers and file storage are in Frankfurt, Germany. All processing follows the same security standards, with encryption in transit and at rest.
Frankfurt, Germany
EU (Frankfurt)
Primary regionData residency
Your files are uploaded, stored and deleted in Frankfurt, inside the EU. A choice of preferred region is planned for Enterprise customers.
Data transfers
Transfers to providers outside the UK and EEA are covered by Standard Contractual Clauses and the UK IDTA, and are encrypted in transit.
Built on secure infrastructure
Secure, reliable infrastructure at every layer of the stack
Trusted cloud providers
Hosted on established cloud infrastructure, with data encrypted in transit and at rest.
- Multi-AZ deployment
- Geographic redundancy
- Encrypted, redundant storage
Access to infrastructure is restricted, logged, and encrypted.
Always protected
Multi-layered security at every level of the stack.
- Web Application Firewall (WAF)
- DDoS protection via Cloudflare
- Network segmentation & isolation
Automated monitoring and alerting across our systems.
Proactive security
Continuous monitoring, testing, and improvement of our security posture.
- Regular internal security reviews
- Automated vulnerability scanning
- Responsible disclosure program
We apply security patches promptly after disclosure.
Built for high availability
We monitor our infrastructure around the clock and publish a live status page, so you can check service health and follow any incident in real time.
Security & compliance
The standards and principles that guide how we protect your data
SOC 2
AlignedBuilt to align with SOC 2 principles for security, availability, processing integrity, confidentiality, and privacy.
- Controls modeled on the SOC 2 Trust Services Criteria
- Formal certification on our roadmap
ISO 27001
AlignedAligned with ISO 27001 practices
- Comprehensive risk management framework
- Regular internal security reviews
GDPR
CompliantFull compliance with EU General Data Protection Regulation for data privacy and protection.
- Data Processing Agreements available
- Right to erasure & data portability
- Privacy Impact Assessments conducted
CCPA Compliant
CompliantCalifornia Consumer Privacy Act compliance ensuring transparency and control over personal data.
No payment data collected
Novitora is free and does not process payments, so we never collect, see, or store your card details.
Frequently asked questions
Still have questions? Contact support.
How are my files encrypted during upload and download?
All file transfers use TLS 1.3 encryption with perfect forward secrecy. This means your files are protected by the latest encryption standard during both upload and download. Every connection, including the direct upload to storage, runs over TLS, and the site sends an HSTS header so your browser only ever connects to it over HTTPS.
When are my files deleted from your servers?
By default, files are automatically deleted 2 hours after upload, along with the converted output. Once files are deleted, the stored data is destroyed and cannot be recovered.
Do you store my original files or converted files?
We temporarily store both your original and converted files only for as long as needed to complete the conversion and let you download the result. They are permanently deleted 2 hours after upload and cannot be recovered.
Can Novitora employees access my files?
No. File processing is fully automated with no manual intervention, so our team does not view, access, or read your file contents in the normal course of a conversion. Access to systems is restricted and logged.
Where are your servers located?
Our servers and file storage are in Frankfurt, Germany. All processing follows the same security standards, with encryption in transit and at rest.
Is Novitora GDPR compliant?
Yes, Novitora is built to comply with GDPR. We offer Data Processing Agreements (DPAs) and support the right to erasure and data portability. Our privacy-first architecture ensures data minimization and purpose limitation by design.
What happens if there is a security breach?
We have a documented incident response plan. In the unlikely event of a breach, we will notify affected users within 72 hours as required by GDPR, provide detailed information about the scope and impact, and take immediate remediation steps.
Can I use Novitora for sensitive documents (medical, legal, financial)?
Yes. Every file is encrypted in transit and at rest and deleted automatically 2 hours after upload. We follow SOC 2-aligned practices, with certification on the roadmap. Contact our team to discuss your specific compliance requirements.
Do you have a responsible disclosure program?
Yes. We run a responsible disclosure program. Security researchers can report vulnerabilities through our dedicated security email, and we aim to acknowledge valid reports within 48 hours.
Responsible disclosure
Found a vulnerability? We appreciate security researchers who help keep Novitora and our users safe. Report issues through our responsible disclosure program.
How to report:
- 01Email hello@novitora.com with details
- 02Include steps to reproduce the issue
- 03Allow 48 hours for initial acknowledgment
- 04We credit researchers who report valid issues