Security

Keep this honest. A security page that describes controls you do not actually have is worse than no page at all. Update it when the system changes.

Last updated: [date]

1. In transit

Every connection uses HTTPS. Your browser uploads file data over an encrypted connection using a signed URL that is valid for a short window and for one specific part of one specific file. Nothing travels unencrypted.

2. At rest

The storage bucket has public access disabled. There is no address that serves a stored file without a valid signature, and a signature is only issued after the request has been authorised. Files are stored under generated identifiers rather than their original names, so nothing can be inferred or guessed from a filename.

[If you enable provider-side encryption at rest, say so here and name the provider. Do not claim it otherwise.]

3. Who can open a transfer

A transfer link contains a random token generated from a cryptographic source. Guessing one is not practical. Anyone holding the link can open the transfer — that is the point of a link — so treat it like a key rather than a name.

Adding a password puts a second barrier in front. The password is checked before any filename, size or message is shown: until it is right, the page reveals only that a transfer exists. Repeated wrong attempts are rate limited, per visitor and per transfer.

4. Deletion

Every transfer has an expiry. Expiry is checked on every single request, so a link stops working at the moment it expires, whether or not the cleanup job has run yet. A scheduled job then removes the files from storage permanently.

Nothing is archived. We cannot restore an expired transfer, and neither can anyone who compels us. Keep your own master copies.

5. What we record about downloads

The time, which file, a coarse device type and browser family, and an irreversible hash of the visitor's IP address, salted with a secret unique to this installation. We do not store raw IP addresses. The hash cannot be reversed and cannot be matched against another service's records.

6. Accounts

Passwords are hashed with a modern algorithm and are never stored or logged in readable form. Sessions use HttpOnly, SameSite cookies, and the session identifier is regenerated when you sign in, which closes session fixation. "Keep me signed in" uses a split token whose secret half is stored only as a hash and is replaced every time it is used.

If you sign in with Google, we never receive your Google password. We match your Google account to ours only when Google confirms the email address is verified.

7. What cannot be sent

Executables, scripts and installer formats are refused. Stored files are always served as downloads, never rendered, so an uploaded HTML or SVG file cannot run script in the context of this site. Filenames are sanitised of the tricks used to disguise one file type as another.

8. Inside the application

Database access uses prepared statements throughout. Every state-changing request carries a CSRF token. Responses carry a content security policy, frame denial, MIME-sniffing protection and a strict referrer policy. Sign-in, password attempts, transfer creation and abuse reports are all rate limited. Errors never expose a stack trace, a query or a server path.

9. What we do not claim

We do not offer end-to-end encryption: files are encrypted in transit and access-controlled at rest, but we hold them in a form we could technically read. If your work requires that nobody but the recipient can ever read it, encrypt it yourself before uploading and share the passphrase by another route.

We do not scan files for malware. Do not treat a file as safe because it arrived through this service.

We hold no third-party security certification unless one is named here. [Name any, or leave this sentence as it is.]

10. Reporting a vulnerability

Email [security email]. Tell us what you found and how to reproduce it. Please give us a reasonable period to fix it before publishing. We will not pursue good-faith research that respects other people's data and does not degrade the service for others.