Security

Private by default. Careful by design.

How Storage4Everyone protects your account and your files, written plainly and limited to what we actually do today.

Report a vulnerability Privacy Policy

Sign-in

Passwords are stored with scrypt and a unique salt, never in plain text.
New passwords are checked against known breached passwords.
Email verification is required before first sign-in.
Optional two-step sign-in with passkeys, plus alerts when you sign in from a new IP address.
Sign-in with GitHub or Google uses PKCE and one-time state checks.

Sessions and browser safety

Session cookies are HttpOnly, Secure and SameSite, and expire after 30 days.
Requests that change data are checked against an allow-list of our own sites.
Strict security headers, including HSTS and a content security policy.
Rate limits on sign-in and on every API route.

Access to your files

Every bucket and file request is scoped to its owner.
New buckets are private by default.
API keys are shown once, stored as hashes, limited by scope and bucket, and can expire or be revoked.
Upload and download links expire within an hour; one-time download links work once, for two minutes.
File types are detected from the file itself, and active content such as HTML is served as a download.

Data in transit

All traffic to S4E uses HTTPS.
Our database only accepts encrypted, certificate-verified connections on a private network.
Production refuses to start with insecure connection or secret settings.

Staff access

Every staff account requires multi-factor authentication.
Access is role-based, and sensitive actions need a fresh authentication code.
Staff actions are recorded in audit logs, and account security logs cannot be edited or deleted.
Database access follows least privilege, with separate roles for the app and our staff tools.

Operations

Backend changes are type-checked and tested automatically before they are deployed.
Services run in containers as non-root with a read-only file system.
Encrypted daily database backups are stored off the server.
You can review security events for your own account in the dashboard.

Report a vulnerability

Found a security issue? Email security@storage4everyone.com with the steps to reproduce it and its impact. Please give us reasonable time to fix it before sharing it publicly, and do not access other users' data, run denial-of-service tests or use automated scanners at high volume.

We will acknowledge your report, keep you updated, and will not take legal action against good-faith research that follows these rules. We do not run a paid bug bounty.

Where we are today

Storage4Everyone is in early access. We have not completed a third-party security audit or certification such as SOC 2 or ISO 27001, and we do not offer an uptime guarantee yet.

Keep your own backups of important files, protect your API keys, and turn on passkey sign-in. If you think your account is compromised, email security@storage4everyone.com right away.

Part of the Legal Hub. Last updated October 10, 2026.

Sign-in

Passwords are stored with scrypt and a unique salt, never in plain text.

New passwords are checked against known breached passwords.

Email verification is required before first sign-in.

Optional two-step sign-in with passkeys, plus alerts when you sign in from a new IP address.

Sign-in with GitHub or Google uses PKCE and one-time state checks.

Access to your files

Every bucket and file request is scoped to its owner.

New buckets are private by default.

API keys are shown once, stored as hashes, limited by scope and bucket, and can expire or be revoked.

Upload and download links expire within an hour; one-time download links work once, for two minutes.

File types are detected from the file itself, and active content such as HTML is served as a download.

Staff access

Every staff account requires multi-factor authentication.

Access is role-based, and sensitive actions need a fresh authentication code.

Staff actions are recorded in audit logs, and account security logs cannot be edited or deleted.

Database access follows least privilege, with separate roles for the app and our staff tools.

Report a vulnerability

We will acknowledge your report, keep you updated, and will not take legal action against good-faith research that follows these rules. We do not run a paid bug bounty.

Where we are today

Storage4Everyone is in early access. We have not completed a third-party security audit or certification such as SOC 2 or ISO 27001, and we do not offer an uptime guarantee yet.

Keep your own backups of important files, protect your API keys, and turn on passkey sign-in. If you think your account is compromised, email security@storage4everyone.com right away.

Private by default. Careful by design.

Sign-in

Sessions and browser safety

Access to your files

Data in transit

Staff access

Operations

Report a vulnerability

Where we are today

Loading Storage4Everyone Dashboard...

Private by default. Careful by design.

Sign-in

Sessions and browser safety

Access to your files

Data in transit

Staff access

Operations

Report a vulnerability

Where we are today