Every upload is scanned for known malware before it's processed, including files inside archives — tested with real malware signatures embedded in large zip files, not just assumed to work.
Why this has to happen before processing, not after
A file-processing pipeline that doesn't screen uploads is a way to get a third party's compute to unpack and execute something malicious on your behalf — the processing step itself (unzipping, OCR, conversion) can be exactly what triggers a payload if nothing is checked first.
What's actually verified here
Files are scanned for known malware signatures before any processing step touches them, including content packed inside archives — proven with real test signatures embedded in archives well over 100MB, not left as a theoretical claim.
Where this breaks down — said plainly
- Signature-based scanning catches known malware, not zero-day or heavily obfuscated threats. True of any antivirus-style scanner, this one included — it's a real layer, not a complete guarantee.
- Files that can't be fully scanned are excluded from the job and never described as "clean" — a partial scan is disclosed as partial, not quietly treated as a pass.
Related guides
Where this fits on the site: this is part of how every job runs here, across all services. See Services & Pricing for what's actually sold, or go straight to Choose your job.