Security
Your client's work, kept private.
A plain account of how files are stored, who can reach them, and what happens when a transfer expires.
In transit
Every connection uses HTTPS. Your browser uploads file data directly to the storage provider over an encrypted connection using a signed URL that is valid for fifteen minutes and for one specific part of one specific file.
At rest
The storage bucket has public access disabled. There is no URL that serves a stored file without a signature, and signatures are minted only after the request has been authorised. Files are stored under generated keys, never under their original filenames, so nothing can be guessed from a filename.
Who can open a transfer
A transfer link contains a random token from a cryptographic random source. Guessing one is not practical. If you add a password, it is checked before any filename, size or message is revealed — the page shows nothing but the password prompt until it is correct, and repeated wrong attempts are rate limited.
When a transfer expires
A scheduled job deletes the stored objects and marks the transfer expired. The link stops working immediately at the moment of expiry, before that job runs, because expiry is checked on every request. Nothing is archived. Keep your own master copies.
What we record about downloads
The time of the download, which file was taken, a coarse device type and browser family, and an irreversible salted hash of the visitor's IP address. We do not store raw IP addresses, and we do not set advertising or cross-site tracking cookies.
Passwords and accounts
Account passwords are hashed with a modern algorithm and are never stored or logged in a readable form. Sessions use HttpOnly, SameSite cookies, and the session identifier is regenerated when you sign in.
What we block
Executables, scripts and installer formats cannot be sent. Stored files are served only as downloads, never rendered in the browser, so an uploaded HTML or SVG file cannot run in anyone's session.
Reporting a problem
If you believe a transfer breaks the acceptable use policy or infringes your copyright, use the report form. If you have found a security issue in the service itself, please contact us before disclosing it publicly.