---
title: "Security"
description: "How IntoSQL protects your data and how to report a vulnerability."
canonical: https://intosql.com/security
last_updated: 2026-10-14
---

# Security

## How we protect your data

- **Your files stay with you.** The converter runs in your browser, so the files you convert never reach our servers.
- **Encrypted in transit.** The site only answers over HTTPS, and browsers are told never to use anything else.
- **Passwords are hashed** with bcrypt, and accounts can add two-factor authentication or a passkey.
- **Least access.** Only the people who run the servers can reach them, with their own keys and two-factor authentication.
- **No secrets in the code.** An automatic check on every change keeps keys and passwords out of the repository.

## Report a vulnerability

Write to alfonso [at] vexilo [dot] com with what you found, how to reproduce it and what it affects. We answer within 3 working days and keep you informed until it is fixed.

- Give us a reasonable time to fix it before you publish it.
- Don't access, change or delete other people's data, and stop as soon as you can show the problem.
- Don't run tests that degrade the service for others.

If you follow these rules, we won't take legal action against you, and we will credit you if you want.

Our [security.txt](/.well-known/security.txt) has the same contact in a machine-readable form.