Security built in,
not bolted on.
Every upload is checked before it can be shared, files are stored encrypted, and you decide who gets in.
- Malware scanningVirusTotal + our own checks
- GDPR toolsExport or delete your data
- Two-factor sign-inAuthenticator app + backup codes
- Encrypted storageAES-256 at rest on Cloudflare R2
How your file travels.
- 1
On your device
Your browser or the mobile app splits the file into parts and sends several at once, so big files upload faster.
- 2
In transit
Uploads and downloads travel over HTTPS with TLS 1.2 or newer.
- 3
At rest
Files are stored on Cloudflare R2, which encrypts every object with AES-256. Each file is fingerprinted so known-bad files can be blocked.
- 4
Before it's shared
New uploads are scanned with VirusTotal and our image checks. Flagged files are quarantined and never get a working link.
Your data, your rules.
Link controls
Passwords (stored as bcrypt hashes), expiry dates, download limits and private visibility. Some controls depend on your plan.
Account security
Two-factor sign-in with an authenticator app and backup codes, an activity log, and a list of active sessions you can sign out.
Scoped API keys
API keys are stored hashed, limited to the scopes you choose, and can expire or be revoked at any time.
Right to deletion
Delete files any time. Trashed files are removed for good after your plan's retention period, and you can export or delete your account from settings.
Built for scale and safety.
Storage
- Cloudflare R2 object storage
- AES-256 encryption at rest
- Duplicate files stored once
- Regular database backups
Delivery
- Fast downloads from Cloudflare R2
- No speed caps on downloads
- Rate limits on uploads, downloads and sign-in
- Captcha on sensitive actions
Abuse protection
- Malware scanning on uploads
- Image checks for illegal content
- Report and DMCA tools
- Bans for repeat abuse
Monitoring
- Error monitoring with Sentry
- Activity log for your account
- Email alerts for password and 2FA changes
- Human review of flagged files
Found a vulnerability?
If you discover a security vulnerability, please email [email protected] with details. We reply as quickly as we can and work to fix confirmed issues promptly. Please practice responsible disclosure and avoid public disclosure until we've had time to patch.
- Reports go straight to the team
- Direct
- Handling approach
- Confidential