Security

Encryption at Rest

All files stored on FileFlippers™ are encrypted at rest using AES-256 encryption. Our storage provider automatically encrypts every object before it is written to disk and decrypts it when accessed via an authenticated request. You do not need to enable or manage any encryption settings. It is always active.

Encryption in Transit

Every connection to FileFlippers™ uses HTTPS/TLS encryption. This includes:

• Uploads from your browser to our storage backend (via presigned HTTPS URLs)
• Downloads delivered to recipients via time-limited, signed HTTPS URLs
• All API communication between the frontend and our backend, which enforces TLS on every connection
• Payment processing, which operates over TLS with PCI DSS Level 1 compliance

Files are never transmitted in plaintext at any stage of the upload, storage, or download process.

Automatic File Deletion

Files uploaded to FileFlippers™ are automatically deleted from storage when transfers expire. Expiry periods are set at the time of upload and range from 15 minutes to 60 days depending on your plan. Once a transfer expires:

• The files are permanently removed from our storage infrastructure
• The transfer record is marked as expired in our database
• Download links become non-functional

Cancelled or manually deleted transfers are cleaned up immediately. We do not retain file content beyond the specified expiry window.

Authentication and Access Control

FileFlippers™ uses a dedicated authentication service for all user authentication. This includes support for email/password login, Google OAuth, Slack OAuth, magic link sign-in, and password reset flows. Every authenticated session is secured with JSON Web Tokens (JWT).

All database tables are protected by Row Level Security (RLS) policies. This means:

• Users can only access their own profile and transfer data
• Team members can only access transfers within their team
• Download logs are write-only for anonymous users and read-only for transfer owners
• Administrative operations require authenticated service-role access, which is never exposed to the client

Password-Protected Transfers

Pro and Squad users can set a password on any transfer. When enabled, the password is hashed using bcrypt before being stored. Recipients must enter the correct password before they can view file details or generate download links. The plaintext password is never stored or logged.

Infrastructure

FileFlippers™ runs on well-established infrastructure providers:

• File Storage -- Object storage in Western Europe with AES-256 encryption at rest and a global edge network. Files are uploaded directly via presigned URLs and never pass through our application server.
• Database & Auth -- Managed PostgreSQL database, authentication service, serverless functions, and Row Level Security. Hosted with TLS enforcement.
• Frontend Hosting -- Automatic HTTPS, DDoS protection, and global CDN distribution.
• Payment Processing -- PCI DSS Level 1 compliant payment processing. We never store card details; all payment data is handled entirely by our payment provider.

Data Policy

Your files belong to you. We access file content only to the extent required to operate the Platform:

• Malware detection (files up to 2 GB) runs automatically on every upload. We also use automated CSAM hash-matching at our content-delivery layer. No human at FileFlippers™ routinely reviews your file contents.
• If you enable Payment-Gated Delivery, our systems generate a watermarked preview version of your files. This is an automated process. The watermarked preview and the original file are both encrypted at rest.
• File content is stored only to fulfil the transfer you create, and is only accessible via authenticated, time-limited signed URLs.
• We never sell, share, or train AI on your files. That's built into how the platform works, not a line we added to the marketing.

For full details on what personal data we collect and how it is used, see our Privacy Policy.

Reporting a Vulnerability

If you discover a security vulnerability, please contact us at security@fileflippers.com. We take all reports seriously and will respond within 48 hours. Please do not publicly disclose the issue until we have had a reasonable opportunity to address it.