Encrypted at rest
Each file is encrypted with AES-256-GCM before it is written to disk. The key is kept separately from the database, and GCM mode verifies the file has not been tampered with on every read.
Security
Security
Your data is protected at every level
Storage isolation
Uploaded files live outside the web root and cannot be reached by path. Only the application can serve a file, and only after checking the link and permissions.
Two-Factor Authentication
The second login factor is a one-time TOTP code from an authenticator app (Google Authenticator, 1Password, Aegis). Turning it on issues recovery codes in case you lose the phone.
Private by default
Search engines are told not to index file links (robots.txt and X-Robots-Tag), and there is no public file listing. A file opens only through the random link you shared yourself, or from your own dashboard.
What is actually implemented
| AES-256-GCM | Authenticated encryption of file contents on disk, with integrity checking. |
| bcrypt | Passwords are stored only as salted hashes — the original cannot be recovered. |
| TOTP (RFC 6238) | A second factor from your authenticator app plus single-use recovery codes. |
| CSRF | Tokens on every form; session cookies flagged HttpOnly, Secure and SameSite. |
| reCAPTCHA | Checks on sign-in, sign-up and password reset, so passwords cannot be brute-forced by bots. |
SSL/TLS Encryption
All connections to our servers are protected by modern SSL/TLS protocols. We use only TLS 1.2 and above with Perfect Forward Secrecy.
- TLS 1.3 - the newest and most secure protocol
- 256-bit encryption for all connections
- Regular certificate updates
- HSTS to prevent downgrade attacks
Security Recommendations
Use strong passwords
At least 12 characters including letters, numbers, and special characters
Enable 2FA
Two-factor authentication adds additional protection
Regularly check activity
Monitor account logins and activity
Do not share credentials
Never share your password with third parties
Two-Factor Authentication
A second factor from your authenticator app plus single-use recovery codes.