TLS 1.2 or above, with modern cipher suites only. HSTS is set with a long max-age and preloading is enabled. Plain HTTP exists only to redirect.
Objects are encrypted with per-tenant keys. On request, key material is held in a customer-controlled key store so that we cannot decrypt an object without the customer's key service answering.
Links are unguessable tokens, not sequential identifiers. A token grants exactly one object, carries its own expiry and download counter, and can be revoked immediately from the sender's view.
Every upload is inspected before the link activates. Quarantined objects are retained for review by the sending organisation and are never served, including to the sender.
The default retention is 30 days. On expiry the object is deleted and the audit record is kept, so you can still prove that something was sent without still holding it.
Storage and malware inspection are the only sub-processors, both within the European Union. The current list is an annex to the data processing agreement and changes are announced 30 days in advance.
Write to the postal address on this page, or to the security contact named in your contract. We confirm receipt within two working days and will agree a disclosure timeline with you. We do not operate a bug bounty and we do not require you to sign anything before reporting.