Security & Trust

A transparent overview of how MiniFiles handles your data, who processes it, and the controls in place to keep it safe.

Last updated: 28 September 2026

Privacy-by-design architecture

MiniFiles is built around a single privacy principle: your files never leave your device. Image compression (PNG, JPEG, WebP, GIF) and PDF operations — both compression and password protection — run entirely inside your browser using WebAssembly engines. Our servers deliver the application and handle accounts, billing and anonymous usage statistics. They never see, receive, or store your files.

Security controls

100% local file processing

All compression and PDF password protection runs entirely inside your browser using JavaScript and WebAssembly (WASM). Your files are read into browser memory, processed by the engine, and made available for download — all without leaving your device. No file data is transmitted to any server at any point.

Zero file retention

MiniFiles does not store, cache, or log the contents of any file you process. Because processing is local, there is no file data on our servers to retain, delete, or breach. Retention period for your files: zero seconds.

Encryption in transit

All communication between your browser and MiniFiles servers (page load, authentication, analytics) is encrypted using TLS 1.2+. File data is never transmitted, so there is nothing to intercept in transit.

No access to your files

MiniFiles employees, contractors, and systems have no technical ability to access the files you process. The processing architecture makes this impossible by design — the file never leaves your device.

Access control

MiniFiles has no passwords. You sign in with Google (OAuth) or with a one-time magic link sent to your email address. Sign-in and sessions are handled by Better Auth, running in MiniFiles' own serverless functions; your session is kept in a cookie and account data is stored in our Neon Postgres database, encrypted at rest and in transit.

Incident response

In the event of a security incident affecting user account data (not file data, which is never stored), we will notify affected users within 72 hours in compliance with GDPR Article 33. Incidents can be reported via our contact form.

Data we collect (and why)

Data	Purpose	Retention	Legal basis (GDPR)
Email address & account data	Account creation, sign-in (Google or magic link), sessions and plan status	Until account deletion	Contract (Art. 6.1.b)
Billing data	Pro plan payment via Stripe	7 years (tax obligation)	Legal obligation (Art. 6.1.c)
Anonymous compression stats	File format, size before and after, and tool used (compress/protect/merge/split) — no file names or contents	Indefinite (aggregated, not personal)	Legitimate interest (Art. 6.1.f)
Salted hash of IP address (guests only)	Enforce the daily limit for users without an account — raw IP not stored	About 26 hours	Legitimate interest (Art. 6.1.f)
Google Analytics cookies	Website analytics, loaded only if you accept the cookie banner (IP anonymisation on)	Per Google Analytics settings	Consent (Art. 6.1.a)
Contact form messages	Respond to enquiries	Until resolved + 1 year	Legitimate interest (Art. 6.1.f)
Your files	—	Never stored — 0 seconds	N/A (never received)

Sub-processors

The following third-party services process data on behalf of MiniFiles. None of them receive your files.

Neon

Account database (serverless Postgres) · London, UK (AWS eu-west-2)

Stripe

Payment processing (Pro plan) · USA / EU (PCI-DSS Level 1)

Vercel

Hosting & CDN, serverless API functions, KV store, cookieless Web Analytics & Speed Insights · Global CDN — no file processing

Resend

Sign-in (magic link) email delivery · USA

Google

Google sign-in (OAuth) and, only with cookie consent, Google Analytics · USA / Global

Ahrefs

Cookieless, aggregated web analytics · Global

Web3Forms

Contact form delivery · EU

Your rights under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

Right of access (Art. 15)

Request a copy of the data we hold about you.

Right to rectification (Art. 16)

Correct inaccurate personal data.

Right to erasure (Art. 17)

Delete your account and associated data.

Right to restriction (Art. 18)

Limit how we process your data.

Right to portability (Art. 20)

Receive your data in a structured format.

Right to object (Art. 21)

Object to processing based on legitimate interest.

To exercise any of these rights, use our contact form. We will respond within 30 days.

HIPAA and health data

No BAA is needed to process files with MiniFiles, because your files never leave your device. Under HIPAA, a Business Associate Agreement is required when a vendor creates, receives, maintains or transmits protected health information (PHI) for you. MiniFiles processes files in your browser and never receives them, so it is not a business associate for the files you process — and it does not sign BAAs. HIPAA itself still applies to your organisation, and HHS does not certify software, so MiniFiles makes no certification claim. The details below show exactly what does reach our servers, so your privacy or compliance officer can confirm this for your setup.

File contents and names

Never sent to MiniFiles servers. Compression (images, PDFs and video), protection, merging, splitting and PDF-to-image conversion run in your browser. You can confirm this in your browser's Network tab.

Usage counters

For each processed file we record the file format, size before and after, and the tool used — no names, no contents.

Guest daily limit

Without an account, a salted hash of your IP address is kept for about 26 hours to count daily uses.

Website image analyzer

Only when you enter a URL: our server fetches that public page and its images for your browser. Only the site's domain is kept, to count sites analysed; the tool never touches your own files.

Account data

If you sign in: email, name and picture from Google sign-in, session records (IP address and browser) and plan status. Do not put PHI in account details or contact-form messages.

Code loaded from third parties

The Ghostscript engine is downloaded from the jsDelivr CDN. Only code is downloaded; no file data is sent.

Your side

Files stay on your device, so your own safeguards apply: workstation security, where you save the output, and how you share it.

Background reading: is your PDF compressor HIPAA compliant? What to check. This page is a technical description, not legal advice.

Enterprise & B2B enquiries

If your organisation requires a Data Processing Agreement (DPA) under GDPR Article 28, a custom security review, or specific contractual guarantees before deployment, please contact us. We are happy to discuss data residency and audit requirements for teams in regulated sectors such as legal and healthcare.

Responsible disclosure

If you discover a security vulnerability in MiniFiles, please report it via our contact form with the subject line "Security disclosure". We will acknowledge your report within 48 hours and aim to resolve confirmed vulnerabilities within 30 days. We do not operate a bug bounty programme at this time.