You're about to depend on us. Here's why that's safe.
Built and run by two founders, Het and Om. This page is everything we would want to read before making a small, unknown API a production dependency — every claim points at its mechanism, and where we fall short we say so here first.
Most scrapers lie to your agent. Ours files a report.
The failure that scares every AI engineer isn't the crash — it's the silent lie a customer finds first. The core of EnConvert is a refusal to do that.
Each /v2/perceive, /v2/distill, and /v2/watch render runs through a deterministic 8-signal quality model: anti-bot markup, CAPTCHA and bot-detection pages, login walls, empty bodies, JS console errors, failed subresources, cross-domain redirects, and slow renders. The score comes back in the response, read from the real browser session.
When a render trips the anti-bot, CAPTCHA, or login-wall detectors, the response carries an explicit warning naming the condition and the exact deductions that produced the score. You get the full output plus the truth about it — never a challenge page passed off as the answer.
A page flagged as blocked never triggers paid LLM extraction. You get the heuristic result plus a warning explaining the skip, instead of tokens burned inventing structure from a challenge screen.
Send an option we haven’t shipped yet and the API rejects it with a 422 that says so — it never accepts a parameter and quietly ignores it. Partial successes come back as named warnings, never a quiet shrug.
- 92% catch rate, 4% false alarms on our 50-page labeled corpus — roughly 1 in 12 block pages can still slip through, and we publish the misses.
- /v2/ingest renders pages but doesn’t gate on the score yet, so a blocked page can enter a RAG corpus unflagged; that gate is roadmap, not done.
- A low score flags and warns — it doesn’t block delivery or refund the call, and it never silently withholds your content.
Here is exactly what happens to your data.
No abstractions — two flows cover almost everything EnConvert does.
- Arrives over TLS
- Checked against your plan’s size limit and accepted extensions
- Filename sanitized — path components and traversal sequences stripped
- Bytes held in memory, passed straight to the converter — your source file is never written to our storage
- Only the converted output is stored, private, under your account’s own key prefix
- Downloaded via a pre-signed URL: 15-minute expiry, ownership-checked before signing
- Deletable by you, at any time
- Rendered HTML for URL jobs is retained for 90 days to power quality scoring and caching — disclosed in the Privacy Policy, and any single request can turn it off with the X-Enconvert-No-Capture: true header, wired into the pipeline, not just written in a policy.
- Converted files are kept for your plan’s retention window (1 hour on Free up to 30 days on higher tiers), then deleted.
- Metadata is logged (endpoint, sizes, duration, source URL for URL jobs). Your file contents and rendered page bodies are never written to our logs.
No badges. Mechanisms.
We can't hand you a SOC 2 report — so here are the specific controls it's a proxy for, including where each one stops.
Every caller-supplied URL is screened before the browser touches it. Blocked: non-HTTP(S) schemes, embedded credentials, private / loopback / link-local / multicast / reserved address space, cloud metadata endpoints by both IP (169.254.169.254) and hostname, and non-standard IP notations (dotted-octal, hex, packed integer) that a validator and a browser can parse differently. The screen runs on perceive, distill, discover (every link the crawler follows), watch (at creation and before every check), ingest, and on your webhook URL before every delivery.
V2 only — the older V1 url-to-pdf / screenshot / markdown endpoints predate this module and are not screened. Two documented gaps are being hardened: DNS rebinding, and a public URL that redirects to an internal one after the screen. The screen covers the page you request, not every subresource it loads.
Keys carry 256 bits of CSPRNG randomness and are stored only as a SHA-256 hash with a short display prefix — the plaintext is shown once and is not recoverable, by you or by us. Revocation takes effect on the very next request. Keys can be scoped to specific endpoints and domains, enforced server-side on every call. Secret (sk_) keys are refused outright from a browser; publishable (pk_) keys can only mint short-lived, origin-bound tokens for the domains you whitelist. Browser sessions use 1-hour access tokens; the 7-day refresh token lives in an HttpOnly, Secure cookie.
The key hash is unsalted SHA-256 (correct for high-entropy random keys; passwords use bcrypt). A token already minted stays valid until it expires — up to one hour — even after you revoke its key. No per-second rate limiter today; spend is bounded by hard plan quotas checked before every operation.
Every V2 completion and change webhook (ingest, watch) is signed HMAC-SHA256 with the delivery timestamp bound into the signature, Stripe-style, sent as X-Enconvert-Signature and X-Enconvert-Timestamp — so your consumer can verify the sender and reject replays. The per-project signing secret comes from a CSPRNG, is revealed only over the authenticated dashboard, and rotates instantly. A reference constant-time verifier ships with it; deliveries retry on backoff, each attempt re-signed fresh.
V2 webhooks only. The legacy V1 async-conversion callback is unsigned by frozen design — do not rely on it for authenticity.
Every billable conversion writes an append-only ledger row keyed by a deterministic idempotency key, and the counter only moves when that row is inserted, in the same transaction — a retried or duplicated request cannot be counted twice. Failed conversions, failed renders, and quota-denied requests are never billed. At a plan limit you get a 402 with your exact usage numbers before any work runs. LLM extraction spend sits behind an atomic reserve-and-settle cap that fails closed, and a nightly job re-derives every counter from the raw ledger and reports drift rather than silently rewriting your bill.
The quota check and the increment are two steps, so at a cap boundary concurrent requests can overshoot by a handful of operations — always in your favor. Overage billing only applies if you explicitly turn it on.
Use a pk_ key, locked to your domains, for anything client-side — browsers reject sk_ on purpose.
Recompute HMAC-SHA256 over <timestamp>.<body>, compare in constant time, reject anything older than 5 minutes.
A key restricted to the one endpoint it needs can’t do anything else if it leaks.
Rotate a secret or revoke and re-create a key the moment you suspect exposure — revocation is immediate.
Your side of the fence — four things that keep your account safe
Receipts, not promises.
What is actually built, what is actually tested, and honest answers to the failure simulations you're already running in your head.
If the server restarts mid-flight, interrupted batch operations are marked failed with an explicit “resubmit” reason, ingest jobs resume from durable per-page state, and monitors catch up on their own because their schedule lives in the database. The old failure mode of a job stuck “In Progress” forever does not happen here.
A single unrenderable URL fails its own operation and the rest of your batch completes with partial results. A crashed job never takes down the worker loop.
A page watcher that fails three checks in a row pauses itself and emails you, instead of silently pretending to watch.
380-plus automated tests aim squarely at these behaviors: block-detection boundaries, webhook signature-forgery rejection, batch partial-failure, and byte-level render regression against golden fixtures. The quality scorer is gated against a 50-page labeled corpus at 92% detection and 4% false alarms, with the known misses committed to the repo. Honest note: these tests run manually, not in CI yet.
EnConvert runs in a single region today. The status page is public and we are alerted automatically. There is no faceless 24/7 support desk — there are two founders, and one of us is reachable.
There are two of us, by design: Het runs the product day to day, Om covers when Het is not available, and the reverse. On a normal day neither of us needs to press a button anyway — workers self-heal and are restart-safe, monitors auto-pause when they break, and billing periods rotate themselves.
Renders currently serialize through one node, one at a time — a real ceiling we are honest about. Fast conversions return synchronously; heavy or bursty work degrades to async jobs rather than failing. Scaling horizontally is planned work, not shipped work.
The real question for a young vendor, so a real answer. The API is stateless: your files live for minutes and hours, not years, so migrating off is swapping an endpoint, not exporting a database. If we ever wind down, you get at least 6 months’ written notice — and on shutdown we release the core conversion code to paying customers, so you are never stranded on a dead black-box API. We put that in writing on purpose.
What we will never do with your files.
- We never train models on your files or your content
- We never sell or share your data
- Source files are processed in memory, never stored — only your converted output is, under your prefix, deletable by you
- Downloads are private and time-boxed: signed URLs, 15-minute expiry, ownership-checked before signing
Object storage for your converted outputs.
LLM-assisted extraction (one of EnConvert’s LLM subprocessors — which one is active is a configurable setting), only on plans where you enable it — trimmed page content is sent to extract structured data; otherwise your content never leaves EnConvert’s infrastructure for this.
LLM-assisted extraction (one of EnConvert’s LLM subprocessors — which one is active is a configurable setting), only on plans where you enable it — trimmed page content is sent to extract structured data; otherwise your content never leaves EnConvert’s infrastructure for this.
LLM-assisted extraction (one of EnConvert’s LLM subprocessors — which one is active is a configurable setting), only on plans where you enable it — trimmed page content is sent to extract structured data; otherwise your content never leaves EnConvert’s infrastructure for this.
The search provider behind /v2/lookup; your search query text is sent to Serper.
Payment processing and billing.
Reasons not to use EnConvert.
Every honest pitch includes the cases where it's the wrong call. Here are ours.
We don’t have them. If a certificate is a hard procurement gate, we’re not there yet.
A two-person company cannot honestly write that — use a larger vendor.
Not offered; EnConvert is a hosted API only.
Per-plan size caps run from small on Free up to the Production tier — past that, wrong tool.
Legitimate. Everything on this page is designed to make it a smaller risk than it sounds, but we won’t pretend it’s zero.
Two names. Reachable.
Bootstrapped, no investors — revenue is subscriptions only, so the product's only job is to keep working for the people paying for it. Support is answered by the people who wrote the code.
Don't trust this page. Check it.
Run 100 operations on the free tier, point /v2/perceive at a page you know is hard, and read the score it gives back. Free while in beta — no credit card.
[email protected] · security reports answered within a business day