What's In a Tax Document
A tax return is a goldmine for identity thieves. It contains:
- Full legal name and date of birth
- Social Security Number or Tax Identification Number
- Home address
- Bank account and routing numbers (for direct deposit)
- Income details
- Employer information
- Dependent information (including children's SSNs)
A single leaked tax return gives someone nearly everything needed to commit financial fraud in your name.
The Risk of Online Converters
Free online file converters have an obvious business model problem: bandwidth and compute aren't free. Services that are genuinely free with no subscription often monetize through advertising — and in some documented cases, through scanning and analyzing uploaded documents.
Even setting aside intentional misuse, uploading sensitive documents to any third-party server creates risk:
- Server breach: If the service is hacked, your document is exposed
- Employee access: Staff may be able to view uploaded files
- Retention: Files may be kept far longer than you expect
- Regulatory gaps: Free services often operate without formal security audits
The Safe Alternative
For tax documents, financial statements, and any document with SSNs or account numbers, use local conversion only. Options:
Browser-based (easiest): HarborConvert's PDF to CSV, PDF to Excel, and PDF to Word converters run entirely in your browser. The file is never uploaded anywhere.
Desktop software: Adobe Acrobat, Microsoft Word (for PDF import), or LibreOffice all perform conversions without network access.
Verify before uploading: If you must use a cloud service, check its privacy policy for data retention terms and look for a SOC 2 or ISO 27001 certification.
Quick Test for Any Service
Before uploading a sensitive document to any online tool:
- Open your browser's Developer Tools (F12)
- Go to the Network tab
- Start the conversion and watch for outgoing requests
- If you see a large file upload (a POST request with megabytes of data), your file is being transmitted
If no such request appears — as is the case with HarborConvert — the conversion is local.