Security
How we protect your data
The safest file is one that never leaves your device. These are the other things we do.
Your files
- Tools process files in your browser. They are not uploaded unless you choose Save to cloud.
- Saved files go to a private Cloudflare R2 bucket. The bucket is not public. Uploads and downloads use signed links that expire in minutes.
- Downloads are always sent as attachments, so an uploaded file cannot run as a web page.
- Each account has its own storage quota. The size of every upload is checked on the server.
Accounts
- Sign in with Google, GitHub or email. Email accounts must confirm the address before using cloud storage or buying a plan.
- Passwords are handled by Supabase Auth. We never see or store them ourselves.
- Sign-in and contact forms can be protected with Cloudflare Turnstile against bots.
- You can sign out of other devices, connect or disconnect sign-in methods, download your data and delete your account from Settings.
Payments
- Payments are in crypto through Plisio. We never receive wallet keys or card numbers.
- Payment notifications are verified with a signature. A plan switches on only when the payment is fully confirmed and the amount matches.
Infrastructure
- Hosted on Vercel. The database is Supabase Postgres with row-level security on every table.
- Secrets stay on the server and are never sent to the browser.
- HTTPS everywhere, with HSTS and security headers.
Access inside the company
- The admin area is role based, and every admin change is written to an audit log.
- Support messages are visible only to admins.
Report a vulnerability
Email support@alltoolsplus.com with the details and steps to reproduce. Please give us a reasonable time to fix the problem before sharing it. We do not run a paid bounty program. Our security.txt has the same contact.