🛡️ Enterprise-Grade Security
Your files deserve the best protection. Here's how we keep them safe.
Security Overview
At send-file.online, security isn't an afterthought—it's the foundation of everything we build. We employ multiple layers of protection to ensure your files remain private and secure from upload to download.
We will never sell, share, or analyze your file contents. Your data is yours alone.
🔐 Encryption
In Transit (TLS 1.3)
All connections to send-file.online are encrypted using TLS 1.3, the latest and most secure transport layer protocol. This ensures that data traveling between your browser and our servers cannot be intercepted or read by third parties.
- Perfect Forward Secrecy (PFS) enabled
- HSTS (HTTP Strict Transport Security) enforced
- A+ rating on SSL Labs security test
At Rest (AES-256-GCM)
Files stored on our servers are encrypted using AES-256-GCM, the same encryption standard used by governments and financial institutions worldwide.
- 256-bit encryption keys
- Authenticated encryption prevents tampering
- Keys stored separately from encrypted data
End-to-End Encryption (E2E) — Optional
For maximum privacy, you can enable client-side encryption. When enabled:
- Files are encrypted in your browser before upload
- Only you and your recipient have the decryption key
- We cannot read your files—even if compelled by law enforcement
- AES-256-GCM with WebCrypto API
🏗️ Infrastructure Security
Cloud Storage (Cloudflare R2)
Your files are stored on Cloudflare R2, a globally distributed object storage system with built-in redundancy and security:
- Data replicated across multiple data centers
- 99.999999999% (11 nines) durability
- DDoS protection included
- No egress fees means we can prioritize security over cost
Server Security
- Servers hardened according to CIS benchmarks
- Regular security patches and updates
- Firewall rules restrict access to essential ports only
- Intrusion detection systems monitor for suspicious activity
Network Protection
- Cloudflare CDN for DDoS mitigation
- Rate limiting prevents brute-force attacks
- Bot detection blocks automated abuse
- Geographic access controls available
🔑 Access Control
File Access Security
Every file uploaded to send-file.online is protected by multiple access control mechanisms:
| Unique File Code | Cryptographically random 8-character code (62^8 = 218 trillion possibilities) |
| Password Protection | Optional password requirement for downloads (bcrypt hashed) |
| Download Limits | Auto-delete after X downloads (configurable) |
| Time-Based Expiry | Auto-delete after set retention period |
| One-Time Links | Self-destructing links for sensitive files |
Account Security
- Passwords hashed with bcrypt (cost factor 12)
- Session tokens regenerated on login
- Secure, HttpOnly, SameSite cookies
- Two-Factor Authentication (2FA) available for PRO users
📋 Compliance & Standards
GDPR Compliance
We are fully compliant with the General Data Protection Regulation (GDPR):
- Data minimization—we only collect what's necessary
- Right to erasure—files are automatically deleted
- Data portability—download your data anytime
- Clear privacy policy and cookie consent
Content Moderation
We employ automated systems to detect and remove illegal content:
- PhotoDNA hash matching for CSAM detection
- Malware scanning on uploads
- DMCA takedown process for copyright claims
- 24/7 abuse reporting system
🐛 Security Reporting
Found a security vulnerability? We appreciate responsible disclosure.
Please email security issues to: security@send-file.online
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Your contact information (for follow-up)
We commit to:
- Acknowledge receipt within 24 hours
- Provide a detailed response within 72 hours
- Credit you publicly (if desired) after the fix
- Never take legal action against good-faith researchers