Security
How IntoSQL protects your data and how to report a vulnerability.
How we protect your data
- Your files stay with you. The converter runs in your browser, so the files you convert never reach our servers.
- Encrypted in transit. The site only answers over HTTPS, and browsers are told never to use anything else.
- Passwords are hashed with bcrypt, and accounts can add two-factor authentication or a passkey.
- Least access. Only the people who run the servers can reach them, with their own keys and two-factor authentication.
- No secrets in the code. An automatic check on every change keeps keys and passwords out of the repository.
Report a vulnerability
Write to alfonso [at] vexilo [dot] com with what you found, how to reproduce it and what it affects. We answer within 3 working days and keep you informed until it is fixed.
- Give us a reasonable time to fix it before you publish it.
- Don't access, change or delete other people's data, and stop as soon as you can show the problem.
- Don't run tests that degrade the service for others.
If you follow these rules, we won't take legal action against you, and we will credit you if you want.
Our security.txt has the same contact in a machine-readable form.