Secure Excel conversion for business and customer data
Secure Excel conversion in XlsConverter means files are encrypted in transit and at rest, processed in an isolated job, deleted automatically one hour after conversion by default, never used to train AI models, and workbook passwords are never stored.
Spreadsheets carry price lists, payroll, customer records and financial data. Before a team sends them through any online converter, someone in IT, finance or legal asks where the files go, who can read them and how long they stay. This page answers those questions plainly, with what the service does today and nothing more.
Files deleted after conversion
We keep your files only as long as needed to deliver the result. Deletion is automatic and does not depend on anyone remembering to clean up.
- Uploaded files and results deleted one hour after the conversion finishes by default
- Shorter windows available on paid plans
- Enterprise retention controls, including deletion immediately after download
- Conversion history keeps metadata only, never file contents
Encryption at rest and in transit
Files are protected on the network and on disk, from the upload until deletion.
- TLS 1.2 or higher for every connection to the web app and the API
- AES-256 encryption at rest for files and integration credentials
- Credentials of your S3, Drive, Dropbox and SFTP connections stored encrypted
Isolated processing and protected workbooks
Each conversion runs as its own job, so one file is never mixed with another. Password protected workbooks are opened with the password you type, which stays in memory for that job only.
- Isolated processing per conversion job
- Workbook passwords used in memory, never stored and never logged
- Uploaded files checked for type and size before processing
API keys and signed webhooks
Machine access gets the same care as human access. Keys can be revoked at once, and outgoing events can be verified by your servers.
- API keys stored hashed, shown in full only once at creation
- Webhooks signed with HMAC SHA-256 in the X-XlsConverter-Signature header
- Delivery log with every webhook attempt and status code
Access control on Enterprise
Larger teams need to control who can see which pipelines and files, and to show auditors what happened.
- Single sign-on with SAML, Google Workspace and Microsoft Entra
- Roles for owners, admins, members and viewers
- Audit log of sign ins, pipeline changes, key changes and downloads
- Choice of EU or US processing region for files
AI features and your data
AI header normalization is optional and available on paid plans. When you use it, only column headers and a small sample of rows are sent to an AI text model provider to match headers to your schema.
- No training of AI models on customer files
- Full files never sent to an AI provider
- Feature can be left unused in every pipeline
Privacy documents for your review
Your legal and procurement teams get the documents they need without a sales call.
- Data processing agreement available in the account settings
- Privacy policy listing data categories, purposes and recipient categories
- Standard contractual clauses for international transfers
- Security questions answered at [email protected]
Security questions
How long do you keep my uploaded files
+
Files and results are deleted automatically one hour after the conversion finishes by default. Paid plans can shorten this, and Enterprise accounts can delete files immediately after download or set a custom retention window.
Do you store the passwords of protected workbooks
+
No. The password you type is used in memory for that single conversion and is never written to disk, stored in a database or written to logs.
Are my files used to train AI models
+
No. Customer files are never used to train AI models. Optional AI header normalization sends only headers and a small sample of rows to match columns, and only when you turn it on in a pipeline or conversion.
Can we choose where our files are processed
+
Yes, on the Enterprise plan you can choose an EU or US processing region for your files. Other plans use the default region of the service.
Is a data processing agreement available
+
Yes. A DPA is available in the account settings for every paid account, so you can review and accept it without contacting sales.
Do you hold security certifications
+
We describe the controls we actually run on this page: encryption, automatic deletion, isolated jobs, hashed keys, signed webhooks, SSO and audit log. For detailed security questionnaires, write to [email protected].