— I. Encryption

Encryption.

A · TRANSPORT

HTTPS/TLS in transit

Browser connections use HTTPS/TLS. HTTP requests redirect to HTTPS, and the site sends an HSTS policy to supporting browsers.

B · STORAGE

Private file storage

Uploaded file objects are stored in France. Access uses temporary storage URLs issued after FileSendX checks the transfer. FileSendX is not end-to-end or zero-knowledge encrypted.

C · LINKS

Presigned download URLs

FileSendX checks expiry, password protection and burn-after-reading before issuing a storage URL. That URL lasts 15 minutes for a burn transfer or one hour for an ordinary transfer. Anyone holding it can use it while valid.

D · PASSWORDS

Password-protected files

File passwords are stored as salted one-way hashes. The recipient enters the password before FileSendX authorizes the download. This access check does not encrypt the file itself.

— II. Authentication

Authentication.

Two-factor authentication

Available on every plan, including Free. Works with Google Authenticator, Authy, 1Password, Bitwarden, Microsoft Authenticator, and any other standard authenticator app.

Brute-force protection

Login attempts are rate-limited. Repeated failures lock the account temporarily; every attempt is recorded with timestamp and source IP.

Strong password policy

Minimum 12 characters with mixed case, digits, and symbols. Passwords are hashed; we never log them in plaintext.

Single sign-on (SSO)

Standards-compliant SAML on every paid plan. Connect Okta, Microsoft Entra ID, Google Workspace, Keycloak, Auth0, OneLogin, and any major identity provider.

Auto-provisioning (SCIM)

On every paid plan: your IdP creates and removes FileSendX accounts automatically. Offboarding happens the moment your IdP updates.

— III. Access control

Access control and audit.

Role-based access control

Two roles per team: member and admin. Members can send and download files; admins additionally manage teammates, billing, SSO/SCIM, and the audit log.

Audit log

Admins can review supported account and team events in the audit log. Each sender separately retains personal transfer history and download counts; these are not certified proof of receipt.

Burn after reading

Enabled by default and optional. The FileSendX link authorizes one download request. Stored bytes become eligible for cleanup after a two-hour delivery grace period; the cleanup runs every five minutes and retries failed deletions. Transfer metadata remains in the sender's history.

Expiring links

7 days on Free, 30 days on Starter and Pro. After expiry the file is permanently deleted from object storage and we cannot recover it. Your send history keeps a record of the transfer (sender, recipient, dates), without the file.

— IV. Residency

Data residency.

Uploaded file objects are stored in France. Recipients can download from other countries; file storage location does not describe every service processor or every destination.

Payments use Stripe, abuse prevention uses Cloudflare Turnstile, and Google Analytics loads only after consent. The privacy policy documents those processors and the applicable international-transfer safeguards. For questions, email contact@dynamic-foundries.com.

— V. GDPR

GDPR.

Account holders can exercise GDPR rights — access, rectification, erasure, portability, objection, restriction — by emailing contact@dynamic-foundries.com with the subject "Data Protection Request". We respond within 30 days.

Full retention details, sub-processor list, and legal basis per data category are in the privacy policy. Read the privacy policy →

— VI. Disclosure

Responsible disclosure.

If you've found a security issue, please email contact@dynamic-foundries.com with the subject "Security disclosure". We acknowledge reports within 48 hours and aim to ship a fix within 30 days for high-severity issues.

Please do not test against live user accounts other than your own. If you need a clean test account, ask and we'll provision one.

Security & trust