Frequently Asked Questions
How are my files protected?
Every file is encrypted with AES-256-CBC before it leaves our system — each one gets a unique encryption key so no two files are ever encrypted the same way. Files travel over an SSL/TLS connection, so they're protected in transit too. You can also add a password to your transfer, which is hashed with bcrypt before being stored — we never hold your password in plain text. For an extra layer of security, consider zipping and password protecting your files before uploading.
How much data can I share?
You can securely share up to 10GB of files per transfer with anyone. No account is required — just upload your files, get a link, and share it.
Do recipients need an account?
No. Anyone with the download link (and password, if set) can access the files. No registration or account is needed.
What file types can I upload?
Most common file types are supported, including documents, images, videos, archives, and more. Executable files and scripts are blocked for security reasons.
Where is my data stored?
Your encrypted files are stored in a UK-based data centre via IDrive e2 (eu-west-2 region). No file data is ever written to or retained on our application servers — they handle the encryption and routing, and that's it. Everything stays within the UK.
How long is my data kept, and when is it deleted?
You choose how long your transfer stays active — from 24 hours to 30 days. Once that window closes, or your download limit is hit (whichever comes first), the files are permanently deleted from storage. We run automated cleanup every hour to make sure nothing lingers beyond its expiry. We don't archive or back up your transfers.
Can SendSafe staff access my files?
No. Files are encrypted before they're stored, and the encryption keys are never held alongside the files themselves. Even with direct access to the storage bucket, the files would be unreadable without the corresponding key. For maximum peace of mind, you can also zip and password protect your files before uploading.
Is there any protection against abuse or excessive use?
Yes. Rate limiting is applied to both uploads and downloads to protect the service from abuse and brute-force attempts. Dangerous file types — such as executables, scripts, and server-side code — are blocked outright on upload. We also check for disguised file extensions (e.g. a file named to look like an image but actually a script).