Security
How the services are secured.
What we protect, and what stays on your side.
Files: sign-in and links
Turn on two-factor authentication for your account, so that a stolen password is not enough to sign in. Give share links a password and an expiry date, and delete the ones you no longer need: a link without a password opens for anyone who has it.
Files: encrypted libraries
When you create a library, you can make it encrypted. The server does not keep the library password, so store it carefully: we cannot restore it, and without it the files cannot be read. For the strictest setup, open encrypted libraries only through the desktop client; the web interface needs the password sent to the server while you work. Encryption is optional and covers only the libraries you create this way.
S3: access keys
A key is issued for specific buckets and shown once, when it is created. Use a separate key for each application or server: if one leaks, you can revoke it without touching the others.
S3: encryption
Objects are encrypted on the server before they are written to disk. We still recommend encrypting backups on the client: restic does it by default, and rclone has a crypt mode. Then nobody but you can read the data, and that includes us.
Protection from deletion
In file storage, earlier versions of a file are kept and deleted files go to the trash. In S3, versioning keeps earlier versions of an object, and object lock prevents a version from being deleted until its retention period ends; both are off until you turn them on for a bucket. None of this replaces a second copy: keep anything critical in one more place.
On our side
The website, the file storage, the control panel, and the S3 endpoint work over TLS only. We do not look inside stored files or objects unless running the service or the law requires it, and we use them only to store them and return them to you. Staff access is limited to what operating the service needs. Request logs record the time, the source address, and the operation, not the contents.
Reporting a vulnerability
Email the address below and describe how to reproduce the problem. We will confirm that we received the report and tell you what we find. While testing, please do not access other customers’ data or disrupt the service. The same contact is listed in security.txt.