Security Architecture
Encryption in Transit
Files are encrypted using AES-256-GCM as they are served to the recipient. Access is gated by a validated session — no direct storage URL exists that bypasses this layer.
No Public URLs
Files cannot be accessed via direct storage URLs. Client access is brokered through short-lived (15-minute) JWT session tokens that enforce authorization before serving chunks.
True Deletion
Expiry means deletion. When a file hits its view limit or time limit, the storage object and storage object is permanently deleted. There is no recovery window or soft-delete archive.
Dynamic Watermarking
Files are rendered in a secure canvas viewer, not passed as downloadable blobs. A dense watermark containing the recipient's email and timestamp is burned into the display to deter leaks.
Threat Model
What we prevent
- Casual forwarding (links expire)
- File downloads and saving
- Standard OS screenshot shortcuts
- Browser screen sharing / recording
- Print and Context Menu actions
What we do not prevent
No software can prevent an analog capture of a physical screen.
- Taking a photo of the monitor with a smartphone.
- Advanced hardware capture cards.
Our watermarking ensures that if an analog leak happens, the origin (who leaked it and when) is permanently visible in the photo.