Security

FilesDue is not designed for protected health information (PHI) or HIPAA-covered use. Do not upload medical records.

• Private object storage with server-side encryption (AES-256-GCM locally; S3/R2 SSE in production).
• Short-lived signed download URLs; upload links use long unguessable tokens.
• Passwords hashed with bcrypt (cost 12).
• HttpOnly session cookies, CSRF protection on state-changing forms, rate limiting on auth and uploads.
• Uploaded files are never rendered inline as HTML; downloads use nosniff and attachment disposition.
• Configurable retention (30/60/90/180 days after completion) with automatic purge.
• Audit log of signup, login, request create, uploads, ZIP downloads, and purges.

Questions: security@filesdue.com (configure before launch).