How it works

The short version: we hold your document encrypted, we never hand out a URL that reads it, and every read goes through a check we can revoke. Here is the longer version, without hiding behind the word "secure".

When you upload

Your file is read into memory, never written to our disk. We generate a fresh 256-bit key for that one document and encrypt it with AES-256-GCM. Only the ciphertext goes to storage -- as a private object, with a random name that carries no filename and no email address.

That per-document key is then itself encrypted with a master key that lives only in the running server's environment, and the encrypted form is what the database holds. So a stolen bucket gives an attacker ciphertext, and a stolen database gives them a key they cannot unwrap. They would need both plus the server's environment.

When your recipient opens it

They get a link. Opening that link grants nothing -- it shows a page with one button. Pressing it emails a single-use confirmation link to their own address, which is the part a forwarded email cannot reproduce. Clicking that is what opens the document, and the access is tied to that browser for 24 hours.

That two-step shape is deliberate elsewhere too: corporate mail scanners fetch every URL in inbound mail. If merely loading a link granted access, a machine would be burning your recipient's one-time token -- or reading their document.

When you revoke access

Revocation is immediate because there is nothing to chase. We never issue a pre-signed or public URL, so there is no live link out in the world to expire. Every read is served by us, from ciphertext we decrypt for that one request, after checking revocation and expiry. Delete goes further: the ciphertext is destroyed in storage and the wrapped key is destroyed in the database, so the copy we were holding is gone for good -- for you, for us, for anyone. What it cannot do is reach a file someone already downloaded to their own machine.

What we can't do

Being straight about the limits, because a security product that oversells is worse than one that doesn't exist: