Security and data handling

Last updated October 16, 2026 by the stl2step team

Files you upload to stl2step travel over HTTPS, are stored in Frankfurt, are converted on Modal Labs' servers and are visible only to your account, which keeps them for 30 days. A copy of every mesh and STEP file, with no link to you, stays in our library and is used to improve the models. Do not upload files you must keep confidential.

Connection

HTTPS only, on the website, the API and file transfers. Browsers are told to use HTTPS for a year (HSTS), subdomains included.

Sign-in

No passwords: a 6-digit code sent to your email, valid for 15 minutes.

Who sees your files

Only your account. Files and results are deleted from your account after 30 days; you can delete them sooner in the app. Deleting your account deletes your copies and everything else we hold about you, except billing records the law requires.

Library copy

We keep a copy of every uploaded mesh and every STEP file we produce, stored under a hash of the file's contents and not linked to any account, email address or payment. It returns identical results instantly and is used to measure and improve our models, including training them. It is never published or sold, and it stays when you delete your copy or your account.

Storage

Accounts, database and files: Appwrite Cloud, in Frankfurt, Germany.

Conversion

Conversions run on Modal Labs' cloud servers; the file is fetched for the conversion and the results are stored back in Appwrite.

Payments

Card details are entered on Stripe's own checkout page and never reach our servers.

Without an account

No email address or name is collected. A salted one-way hash of the IP address is kept only to limit how many conversions one address can run.

Website

Served by Cloudflare. Analytics: Cloudflare Web Analytics and Google Analytics through Google Tag Manager (see the privacy notice for what Google receives).