Security & Data Processing

No backend for your files

ToolQiva is a static site — there's no server-side database or file-storage backend behind it. For any tool marked "processed locally," your file is read and transformed entirely in your browser using the File API, Canvas, and libraries such as pdf-lib and pdf.js loaded into the page; it is never transmitted anywhere, so there's nothing on a server to secure or breach in the first place.

Tools that say they're unavailable

A handful of operations (real PDF password encryption, rebuilding an editable PowerPoint from a PDF, and similar) genuinely need server-side processing this site doesn't have. Rather than silently route your file somewhere, those pages say plainly that the operation is unavailable — see the Disclaimer.

No accounts, no passwords

ToolQiva has no user accounts, login, or password storage of any kind — there's nothing to hack into on that front.

Transport and headers

The site is served over HTTPS and sends a Content-Security-Policy header restricting where scripts, styles and connections can come from, plus an X-Content-Type-Options header — standard hardening for a static site, not a claim of formal certification.

Reporting a vulnerability

If you find a genuine security issue — a tool that silently sends data somewhere it shouldn't, an XSS vector, anything like that — email info@toolqiva.com with details before disclosing it publicly, so it can be fixed first.

ToolQiva is an independent project based in India. Contact: info@toolqiva.com.