Our approach
Nexynto Tools uses processing disclosures, bounded inputs, review steps and workflow-specific safeguards. Security is treated as a system of product, backend, hosting and operational controls—not a badge or an absolute promise.
Processing transparency
| Mode | What it means | User check |
|---|---|---|
| Browser-local | The selected file is processed with browser code or a worker and is designed not to be uploaded to the Nexynto conversion API. | Confirm the tool says “Runs in your browser.” |
| Temporary server | The file is uploaded for a conversion or security operation and becomes eligible for cleanup after the configured expiry. | Review retention and avoid content unsuitable for server processing. |
| Hybrid | Part of the task occurs locally and another part may use the backend. | Follow the exact tool disclosure. |
| AI-assisted | Relevant content and instructions reach backend and configured AI services. | Minimize input and verify all important output. |
Repository-visible safeguards
- File type, size and workflow validation in shared and tool-specific paths.
- Server-side provider credentials rather than exposing AI keys in the browser.
- Expiring job, download and Transfer access records with cleanup functions.
- Hashed Transfer passwords and short-lived signed access tokens.
- Human approval before suggested AI redactions are applied.
- Output inspection and verification steps in selected document workflows.
- Defensive response headers configured by the frontend.
Production identity, privileged access, centralized logging, monitoring, vulnerability management, backup, incident response and supplier controls require separate operational evidence.
Review and verification
Conversion, OCR, privacy scanning, redaction and AI results can have limits. Nexynto surfaces review steps where implemented, but users should reopen important outputs, compare them with the source and keep a controlled original.
What this page does not claim
This page does not represent certification, a completed compliance audit, continuous availability, zero retention, universal local processing, malware scanning, end-to-end encryption, or immunity from security incidents. The current Transfer backend explicitly reports its scan provider as not configured unless deployment adds one.
Report a security concern
Use the Contact page and select the security-inquiry category once an approved channel is published. Do not place vulnerability details or sensitive files in a public issue. A dedicated security-reporting inbox is not currently evidenced.
Need another trust document?