Clear, verifiable security controls — without exaggerated claims.
Security documentation should state exactly how your files are handled, verified, scanned and deleted. This is our operational architecture and threat model.
Browser
SigV4 presigned PUT
Quarantine
Private bucket · lon1
Verify + scan
HEAD size · ClamAV
Share link
HMAC token minted
Four controls that do the heavy lifting.
Fail-closed quarantine & ClamAV scanning
A newly uploaded object never becomes downloadable simply because a browser reports completion. Every file is verified via server-side S3 HEAD size checks and scanned inside an isolated ClamAV worker before the API mints a share token. If the scanner times out or is unreachable, activation fails closed.
Private object storage & short-lived URLs
Files are stored in a private DigitalOcean Spaces bucket (London lon1 region) using opaque UUID keys — filenames are never exposed in storage keys. Recipients never receive raw bucket links; after access checks pass, the API issues a 90-second presigned GET URL with Content-Disposition: attachment.
Token & password cryptography
Share tokens and guest management tokens are generated using a CSPRNG and stored at rest exclusively as keyed HMAC-SHA256 digests. Optional transfer passwords are hashed with memory-hard key derivation and protected by per-transfer failed-attempt counters.
Honest encryption disclosure
All transfers are encrypted in transit over HTTPS/TLS 1.3 and stored in private, access-controlled buckets. Because our isolated worker scans files for malware to protect recipients, Attach & Send is not a client-side zero-knowledge end-to-end encrypted (E2EE) system.
What happens when a link ends.
Expiry and revocation follow the same path, so there is no ambiguity about what remains.
- 1
Expiry or revoke
The API immediately blocks any new download sessions for the transfer.
- 2
Object deletion queued
Storage objects are queued for deletion from DigitalOcean Spaces.
- 3
Presigned URLs lapse
Any previously issued 90-second GET URL expires at the end of its window.
- 4
Multipart cleanup
Abandoned multipart uploads are aborted by our worker and by bucket lifecycle rules.
Found something? Tell us.
Report suspected abuse or a security concern and we will respond from a monitored inbox.