Security & trust
How Morphix protects your files
This page is maintained by the Morphix team to answer common security and privacy questions about the app. It describes the controls that are visible in the product today — it is not a certification or an independent audit.
Local-only processing
Conversions run in your browser tab through WebAssembly and Canvas. File bytes stay in page memory and are released when you close the tab.
No file storage
We operate no conversion servers and no file buckets. There is no copy of your document for us to lose, sell, or be compelled to hand over.
HTTPS everywhere
The whole site is served over TLS from an edge network, with HSTS-friendly redirects from the www and legacy hostnames.
Client-side encryption
Morphix Vault uses AES-256-GCM through the browser's Web Crypto API with PBKDF2 key stretching. Keys are derived from your password locally.
What data we do and don't collect
We never collect the contents, names, or metadata of the files you convert, because those never reach us. What we do process is limited to:
- Aggregate, non-identifying usage counts (page views, total conversions run).
- Your email address and subscription status if you buy Pro, so we can restore your plan across devices.
- Cookie-consent preferences and, where you allow them, advertising and analytics cookies described in our Cookie Policy.
Payments
Subscriptions are handled by Stripe. Card numbers are entered directly into Stripe's hosted checkout and never touch Morphix — we only receive a subscription status back.
Cross-device transfers
"Send to Device" opens a direct WebRTC peer-to-peer channel between your two browsers. The bytes travel device-to-device over an encrypted DTLS channel; the pairing code only helps the peers find each other and expires shortly after use. There is no upload link and no stored copy.
Shared responsibility
Morphix runs on a managed hosting and database platform that handles TLS termination, patching and infrastructure security. We are responsible for the application code, access controls and the data-handling practices described here. You are responsible for keeping your device and browser up to date, and for remembering Vault passwords — we cannot reset them.
Verify it yourself
Open your browser's developer tools, switch to the Network tab, and run a conversion. You will see the app's own assets load — and no request carrying your file. You can also disconnect from the internet after the page loads and keep converting.
Reporting a vulnerability
Found a security issue? Please report it through our contact form with steps to reproduce, and give us a reasonable window to fix it before disclosing publicly. We read every report and will credit you if you'd like.