Is CloudConvert safe?

The short answer

CloudConvert is a long-running file conversion service from Lunaweb GmbH in Munich, Germany, and it is legitimate. By the standards of upload-based converters its published practices are strong. If you are converting a holiday video or a logo, it is a reasonable choice.

What no upload service can change is the basic fact of an upload: for a while, a complete copy of your file is on someone else’s computer. For a contract, a scanned passport, medical records or anything under a confidentiality agreement, the safest converter is one where the file never leaves your device. That is the question this page helps you answer.

What CloudConvert says it does with your files

As of October 2026, per CloudConvert’s security page and privacy policy:

• Deletion. Files are deleted when you press the delete (×) button, and automatically after 24 hours at the latest. It offers no permanent storage.
• Isolation. Each conversion runs in its own isolated container, and the company says its staff cannot technically access your files.
• Encryption. Transfers to and from the service use SSL/TLS.
• Location and law. Processing happens in the region you select, on ISO 27001 certified cloud providers including AWS, and the company is bound by German and EU data protection law (GDPR).
• Certification. Its own information security management system is ISO 27001 certified by TÜV Süd.

Those are good practices. They describe how a well-run server handles your file, which is the part you have to take on trust.

What any upload still means

None of the following is specific to CloudConvert; it applies to every service that converts on a server. Your file travels over the internet, sits on a machine you cannot inspect for up to a day, and is covered by the company’s policies and the law where it is processed. Deletion promises are about the file store; you cannot audit logs, backups or the conversion workers yourself.

For many people and most files, that trade is fine. It becomes a problem when a rule says the file must not leave your control: an employer’s data policy, a client NDA, legal privilege, patient data under HIPAA, or simply a document you would not email to a stranger.

Converting the same files without uploading

Browsers can now do much of this work themselves. Stayput runs conversions in the page, on your own device, so there is no upload to trust: images between JPG, PNG, WebP, HEIC, AVIF, TIFF and more with the image converter, iPhone photos with HEIC to JPG, sound out of videos with Video to MP3, and clips to animations with Video to GIF.

CloudConvert handles far more formats than a browser can, including office documents, e-books, CAD files and professional video codecs, so it remains the right tool for many jobs. A good rule of thumb: private file in a common format, convert it locally; unusual format and nothing sensitive, an established service like CloudConvert is fine.

How to check any converter yourself

Whatever a site says, you can see whether it uploads. Open your browser’s network panel, add a file and watch for an outgoing request the size of your file; or, after one visit and a short wait, switch on airplane mode and try it. Our guide Does this website upload my files? walks through both checks in five minutes.

Questions