Security and infrastructure

How we protect your account and your files

This page describes what the service does today, in plain words. When something changes, we update this page, our Security Overview and our changelog.

Where the service runs

Your files are kept in the European Union, or in the United States if you choose, using our storage provider’s data-location controls. You choose when you order a cloud, and it can’t be moved by mistake later. Clouds opened before this choice existed stay in our earlier storage in Western Europe, and each cloud’s page shows where its files are kept. Our application and database run on servers rented from Hetzner, in a data centre in the European Economic Area. The full list of companies that help us run the service is on the Subprocessors page.

Today the service runs on one main server. That keeps it simple and affordable, but it also means planned maintenance or a fault on that server can take the service offline for a while. We tell you about planned work in your account beforehand.

Encryption

In transit: Every page and file transfer uses HTTPS (TLS 1.2 or 1.3). Plain HTTP is redirected to HTTPS.
At rest: Files are stored with Cloudflare R2, which encrypts every stored file. Database backups are encrypted with AES-256 before they leave our server.
Passwords: We never store your password, only a one-way hash made with Argon2id, a method recommended for passwords.
Private vault (Beta): On paid plans, each cloud can have a private vault: files and their names are encrypted in your browser with a key made from a passphrase only you know, so we can’t open them. If you lose both the passphrase and your recovery key, nobody can. See how the private vault works.

Backups

What we keep so that we can recover from a mistake or a fault.

The database, which holds your account, billing and file records, is copied every day.
An encrypted copy goes to separate storage away from our server every day. Copies are kept for 45 days and can’t be deleted for their first 7 days, even by us.
Database changes are also sent away from the server every few minutes, so we can usually restore it to within about 20 minutes of a problem.
Once a month, a restore from the off-server copy is tested automatically.
Your files themselves are stored with Cloudflare R2, which is built to keep data safe against hardware failure. We don’t keep a second copy of your files elsewhere. If you delete a file, it stays in the trash for 30 days, so you can put it back.

Your account

Two-step sign-in: Any account can turn on codes from an authenticator app, with single-use recovery codes.
Your sessions: You can see where you’re signed in and sign other sessions out.
Protection against automated attacks: Sign-up and sign-in forms check for bots, and repeated attempts are slowed down and then blocked.
Private share links: Links to files are long random codes. They expire after up to 7 days on the Free plan and up to 365 days on paid plans, can need a password and can be switched off at any time.
Browser protections: A strict Content Security Policy, HSTS and other protections are set on every page.

Staff access

A separate site for staff: Our staff use a separate admin site with its own sign-in. Two-step sign-in is required for every staff account.
Only what they need: Staff tools show how much space a cloud uses and how many files it holds, not your file names or what’s inside them. We don’t open your files unless you share them with us, for example in a support ticket, or the law requires it.
A record that can’t be changed: Sign-ins, billing changes, file shares and staff actions are written to an activity record that can’t be edited or deleted. You can read your organisation’s record in your account.

Availability

We work to keep the service available on a best-effort basis, as set out in our Support and Maintenance Policy. You can see our measured availability on the service status page.

What we don’t claim

We don’t hold a security certificate such as ISO 27001 or SOC 2, and the service hasn’t had an independent security review yet. That includes the private vault, which is why it’s labelled Beta: we publish exactly how it works so anyone can check it. Our trust centre lists what we have and what we don’t have yet.

Reporting a security problem

If you think you’ve found a security problem, please tell us. Our responsible disclosure policy explains how, what you can test, and what we promise in return.