Why your files are safe
Your files are safe - not because we promise it, but because they never reach us.
Legally on the safe side
- Privacy from the ground up: your files are never transmitted in the first place.
- Data minimisation: we never see your file contents - there is nothing to collect.
- Analytics only with your consent - before that we measure without any cookie or identifier, and you can withdraw the choice at any time.
- Hosted in Germany.
Structurally impossible, not just promised
- 0 upload - files are processed in your browser, not sent.
- 0 account - no sign-up, no registration.
- 0 file bytes on the network - the conversion code has no access to foreign servers (enforced by CSP).
- Analytics strictly separated - it only measures page usage, never your file contents.
Verify it yourself - don’t trust, verify
The airplane-mode test
Switch on airplane mode or disconnect Wi-Fi. Open a tool and convert a file. It keeps working - because nothing is sent. An upload site never could.
The network proof (F12)
Here is how: (1) open the dev tools (F12, or right-click -> "Inspect"). (2) Switch to the "Network" tab and let it record. (3) Open any tool and process a file. (4) Scan the request list: no upload request carrying your file appears - the conversion code cannot reach any foreign address (enforced by CSP). Only the page itself loads, and, after your consent, anonymous usage analytics - never a file’s contents.
The technical lock (CSP)
A strict Content-Security-Policy forbids the code from connecting to any foreign server at all. It is verifiable in the source and guarded by tests - no trust required. The check script that enforces exactly this rule on every build is itself open in this project’s source code under oss/gate-null-upload-static/ - open to read and reuse in your own projects.
Legal background: privacy by design (Art. 25 GDPR) and data minimisation (Art. 5 GDPR) for the file processing. The anonymous usage analytics is measured with a cookie only after your consent (Art. 6(1)(a) GDPR / § 25(1) TDDDG); if you decline, it stays without a cookie and without an identifier. This describes the architecture and is not legal advice; no audited certificates or seals (e.g. ISO, SOC, TÜV) are claimed.
Fast AND secure
Hosted in Germany
The site runs on Hetzner servers in Germany - short routes, GDPR area.
Cloudflare shield
Cloudflare speeds up and protects delivery (DDoS/WAF) - Cloudflare NEVER sees your files, because they never leave your device.
Local processing
Every conversion runs in your browser. Speed and protection do not change the fact that no file is uploaded.
In comparison
| gottrix | Typical online converters | |
|---|---|---|
| File upload | None - all local | File sent to foreign servers |
| Sign-up | None | Often required |
| Analytics cookie | Only after consent | Usually set |
| Works offline | Yes | No |
| Verifiable | Yes (CSP + airplane mode) | Promise only |
Security in technical detail: TLS, HTTP headers and the full Content-Security-Policy
Common questions from data protection, IT security and compliance
Can we use gottrix when cloud uploads are forbidden in our organisation?
That is exactly what it is built for: the conversion runs entirely in your browser and the file is never sent to a server. Where a policy bans uploading documents to online services, the critical step simply does not happen - there is no upload. Your data protection or security team makes the final call; the behaviour is verifiable in the network tab.
Is using it GDPR-compliant?
We give no legal advice and claim no certification. Architecturally, privacy by design and data minimisation help: your file contents never leave the device, so there is no processing of those contents by us and no third-country transfer of them. The optional, consent-based usage analytics is separate and described in the privacy policy. Whether that is sufficient in your specific case is for your controller to assess.
What technically happens to my file - is anything stored?
The file is processed in the browser memory and exists only while the page is open. There is no server storage, no database, no recycle bin - so nothing for us to delete (or that we could). Close the tab and it is gone.
Are my files used to train AI?
No. Because the content never reaches our system, it cannot be used for AI training or any other purpose. There is no server-side processing of your files at all.
How do we evidence this internally (e.g. for an audit)?
Three reproducible proofs: the airplane-mode test (the tool works offline), the network tab (F12 -> no file request during conversion), and the strict Content-Security-Policy in the source. Any team can reproduce these themselves - stronger than a promise.
Do you accept liability or offer an SLA?
No - the service is free and carries no service-level agreement. The protection is not contractual but architectural and self-verifiable: what is never transmitted cannot leak. For binding guarantees, a paid service with a contract is the right route.