Security

How we protect your data and how to tell us if you find a problem.

Does my file get uploaded?

No — for the file tools, your file never leaves your browser. PDF, image, document, audio and data conversions run entirely in your own tab using WebAssembly and JavaScript. There is no upload step, no copy on our servers, and nothing to delete afterwards, because nothing ever arrives.

You do not have to take our word for it.Open your browser's developer tools, switch to the Network tab, and run a conversion — you will see no request carrying your file. Or disconnect from the internet entirely after the page has loaded: the tool still works. An upload-based converter cannot do that, which is the whole difference.

This matters most on documents you are not allowed to upload anywhere — contracts, payroll, medical records, client files, anything covered by an NDA or a data-handling policy. Those are exactly the files our tools were built for.

The exceptions, stated plainly

A small number of tools genuinely need the network, and each one says so on its own page before you use it:

Live-data tools (currency conversion, for example) fetch current rates. They send the currency codes you picked — never your amounts, never a file.
AI tools send your prompt to a model provider, because that is what running a model means. Never use them for confidential material.
Anonymous usage counts. We record that a tool was opened and whether it produced a result, plus a random id used only to count unique visitors. No file names, no file sizes, no contents, and we honour Do Not Track.

If you find a tool that sends data without disclosing it on its page, that is a bug and we want to hear about it — the reporting address is below.

How we protect the site

Transport security: HTTPS everywhere with HSTS preload (2-year max-age, includeSubDomains).
Content Security Policy: per-request nonce on every inline script. Strict script-src with strict-dynamic blocks unknown scripts.
Frame protection: the site cannot be iframed on third-party origins.
Sandboxed tool runners: AI-generated tool code runs inside srcDoc iframes that cannot read cookies, localStorage, or the parent DOM.
CSRF protection: server actions verify same-origin; mutating API routes verify the Origin header.
Cookies: all session cookies are HttpOnly + Secure + SameSite=Strict.
Admin login: rate-limited (5 attempts / 15 min / IP), constant-time password compare, every attempt audit-logged.
Database access: parameterised queries via Prisma. No raw user-supplied SQL.
Rate limiting: Upstash Redis on every mutation endpoint.
Audit trail: every privileged action recorded with actor, IP, timestamp, target.
Webhook security: incoming payment webhooks (when shipped) require HMAC-SHA-256 signature verification with a 5-minute replay window.

Where we host things

Vercel — application hosting, edge network, DDoS protection.
Supabase — primary PostgreSQL database (Singapore region). Encrypted at rest and in transit, with row-level security enabled on every table.
Neon — standby PostgreSQL replica, used only for failover and backups. Same encryption in transit and at rest.
Upstash — Redis for rate limiting + admin settings.
Resend — outbound transactional email. DKIM + SPF + DMARC configured.
Google — OAuth (Sign in with Google) and Tag Manager / Analytics.
OpenRouter — routes requests to AI providers (Anthropic, Google, OpenAI, etc.) for the AI Builder and prompt runner.

Full details, including data flows for each vendor, are in our Privacy Policy.

Reporting a vulnerability

Found something? Email support@7busyboss.com with the subject prefix SECURITY: followed by a one-line summary.

In your report, please include:

The URL and a clear reproduction (curl, screenshot, or video — whatever is fastest)
The impact you believe this has (information disclosure, account takeover, denial of service, etc.)
Whether you accessed any data that wasn't your own
How we can credit you publicly (or whether you'd prefer to stay anonymous)

Our commitment

Acknowledgement within 48 hours.
First remediation update within 7 days.
A coordinated disclosure window of 90 days from initial report.
Public credit in this page's Hall of Fame (below) unless you ask us not to.

Safe-harbour

We won't pursue legal action against good-faith security research that:

Tests only your own accounts and data.
Avoids degrading service for others (no DoS, no automated scraping of user PII).
Reports findings to us before public disclosure.
Does not access, modify, or destroy data that isn't yours.

Out of scope

The following don't qualify as vulnerabilities here:

Missing security headers without a demonstrable exploit chain.
Self-XSS that requires the victim to paste code into their console.
Vulnerabilities affecting only out-of-date browsers (we support evergreen + last 2 majors).
Reports from automated scanners with no manual validation.
Issues in third-party services we use (please report to the vendor directly).
SPF / DKIM / DMARC misconfigurations on subdomains that don't send email.

Hall of fame

No reports yet. Yours could be the first.