File Security & Privacy Architecture
How MasterConverter protects your files, documents, and data at every step.
1. Defense-in-Depth Architecture
Security at MasterConverter is an active release requirement, not an afterthought. Every layer of our ingestion, conversion, storage, and retrieval pipeline is engineered with zero-trust security principles.
2. Storage Isolation
Uploaded files and converted output documents are stored outside the public web root in non-routable private directories. Direct web requests to our storage folders are blocked by server-level rewrite and authentication directives:
- Internal files are assigned unpredictable cryptographic identifiers (e.g.
up_9f81a7b...). - Original filenames are never used as filesystem paths to completely prevent path traversal and shell injection vulnerabilities.
- Directory indexing is strictly disabled across the entire host.
3. Cryptographically Signed Downloads
Downloads do not expose predictable sequential IDs. Every download link is protected by an HMAC SHA-256 cryptographic signature bound to the specific job identifier and timestamp. Any attempt to modify the token, guess another user's download link, or request an expired job is instantly rejected.
4. Automated Lifecycle and Purging
To minimize retention of sensitive data:
- Original uploaded files are deleted immediately after the conversion process completes.
- Converted output files are automatically wiped after 60 minutes by our scheduled cleanup sweeps.
- No long-term file archives or backup snapshots of user files exist.
5. Safe Execution Controls
When external media engines like FFmpeg or document renderers are invoked, arguments are passed as fixed argument lists rather than concatenated shell strings, strictly preventing shell injection attacks. Process execution is bounded by strict timeouts and dedicated temporary working directories.