Privacy & Compliance
GDPR-Compliant File Conversion — No Upload Required
The ConvertYard tool is a web application that is used entirely in the user's browser. There are no files that are uploaded to servers of third parties, such as those of the developer of ConvertYard.
What this means for you
- ✓ Zero GDPR obligations — no data processor agreement needed
- ✓ No BAA required for HIPAA-covered entities
- ✓ No upload logs, no retention risk, no breach surface
- ✓ Verify it yourself: open DevTools → Network while converting
Who this is for
- Legal teams handling contracts and NDAs
- HR processing sensitive employee documents
- Healthcare staff converting patient records
- Finance teams with confidential reports
- Anyone under GDPR, HIPAA, or SOC 2 constraints
How ConvertYard compares
| Feature | ConvertYard | Server-based tools |
|---|---|---|
| Files uploaded to a server | Never | Yes |
| GDPR data processor agreement | Not required | Required |
| HIPAA BAA required | No | Yes, if handling PHI |
| Upload logs retained | None | Varies by provider |
| Breach surface | Zero | Server-side |
| Works offline | Yes | No |
| Cost | Free | Free / Paid |
The details
GDPR by architecture
Under the GDPR, if you upload files containing personal data to third-party services, these services are considered to be data processors for you, and you will need to sign a Data Processor Agreement (DPA) with them. Data processors have a number of obligations, including deletion of personal data, notification of data breaches, and handling of requests from data subjects. ConvertYard is not a data processor because we do not receive your files. Instead, we use WebAssembly to run the same C++ libraries (MuPDF and pdf-lib) that we would normally run on your server, on your CPU instead. Thus, there is no uploaded file and therefore no data processor relationship under the GDPR, in addition to the relationship(s) you already have with your device(s).
No HIPAA BAA required
Under HIPAA, business associates and covered entities must enter into a BAA with vendors that handle PHI (e.g., patient records). For example, if you upload a patient’s record to CloudConvert or Smallpdf, you will need to establish a Business Associate relationship with each company, review a BAA with them, and establish procedures for data retention and for notifying the entity in the event of a breach. None of this is required, however, for files processed by ConvertYard. Never does ConvertYard take possession of the file containing the PHI of your patients. All processing occurs on your local computer. No business associate relationship with you is therefore required.
Verify it yourself — in 30 seconds
Look at your browser DevTools (F12). Open the Network tab. Open up any ConvertYard tool and drag a file into it, then click Convert. You will see requests to load the WebAssembly module for the tool you are using for the first time, but no upload of your file data (just bytes in your browser). That’s the only privacy proof you need to see: no file upload requests in your browser – just local processing of file bytes. No privacy policy needed.
The tools compliance teams use most
Common questions
Does ConvertYard qualify as a GDPR data processor?
No, a DPA is not required because a Data Processor is defined under the GDPR as one who processes personal data on behalf of the Data Controller. ConvertYard doesn’t upload any files to a third-party server, so no data processing is occurring. No DPA is required with ConvertYard.
Do I need a HIPAA BAA to use ConvertYard with patient records?
No, because you are never uploading your files and ConvertYard never receives, creates, or maintains PHI in connection with your use of the service (all processing is done in your browser via WebAssembly). Therefore, ConvertYard is not a Business Associate.
How can I prove files are not uploaded?
Open your browser DevTools (F12), switch to the Network tab. Open a file in a new tab and convert it there with ConvertYard (e.g., by clicking on the Convert button). All you will see in the Network tab is loading the WebAssembly modules that were required on first use of the tool for that type of file, but no upload of your file data to a server. The output of the conversion is assembled locally on your computer. It can then be downloaded from there.
Can ConvertYard be used on air-gapped or restricted networks?
After the first page load, ConvertYard’s WebAssembly modules are cached locally by your browser. Local conversion only happens afterward, and even that does not leave your premises as long as the initial page load was allowed.
Is this true for all ConvertYard tools?
Yes, since all the tools on this website process files locally, such as image converters, PDF processors, video extractors, and document converters, and they run in your browser (or “client-side”) as WebAssembly modules. The privacy guarantee is the architecture, not the tool.
Start converting — no account, no upload, no risk