Access and application controls
- API operations require cryptographically generated API keys. Keys can be rotated from the account API.
- Dashboard sessions use a signed, HttpOnly session cookie alongside a non-sensitive login indicator.
- HTTPS is enforced with HSTS. Responses also set content-type, framing, referrer, camera, microphone, and location restrictions.
- Plan-aware request limits and early upload-size guards constrain resource use before files are stored.
- Remote URL ingestion blocks private and reserved network targets, restricts ports and redirects, and enforces time, size, quota, and concurrency limits.
- Account webhooks are signed with HMAC-SHA256 and retried with bounded backoff.
Infrastructure and recovery
The application and primary database run on Hetzner infrastructure. Uploaded files are primarily stored in Backblaze B2 and delivered through Cloudflare. Cloudflare R2 is configured as a tightly capped fallback for transient primary-storage failures.
Nightly database backup archives are encrypted before they leave the application server and are copied to both B2 and R2. An independent server checks both API hosts, exact file-delivery canaries, both encrypted backup heartbeats, and cross-provider backup identity every five minutes.
See the live status page for the current customer-safe result. Operational checks do not expose backup paths, checksums, credentials, or internal topology.
Retention and deletion
| Data | Normal retention |
|---|---|
| First unverified upload | Available provisionally for up to 24 hours. Email verification promotes it to normal account retention. |
| Verified account files | Until you delete them, a configured expiry runs, or the account is terminated. |
| Active account data | While the account remains active. After a verified deletion request, active-system removal is targeted within 30 days where reasonably possible. |
| Encrypted database backups | Automatic archives age out within 180 days. A deleted record can remain in a protected backup until that backup rotates out. |
| Security, billing, support, and takedown records | May be retained longer when needed to prevent abuse, resolve disputes, or meet legal obligations. |
Current limitations
- FilePost is public hosting, not confidential object storage.
- Uploaded files are not promised to be malware-scanned. Treat files from untrusted uploaders as untrusted input.
- There is no self-serve data processing agreement, private-file mode, customer-managed encryption key, or formal compliance certification today.
- No system can guarantee uninterrupted service or absolute security. The status page reports what FilePost can verify now without inventing historical uptime.
Report a security issue
Email support@filepost.dev with a clear description, affected URL or endpoint, reproduction steps, and likely impact. Avoid accessing other users' data, degrading the service, or publishing sensitive details before there has been time to investigate.
FilePost does not currently operate a paid bug-bounty program. The machine-readable policy is available at /.well-known/security.txt.
Privacy and regulated data
FilePost is based in Sweden. The Privacy Policy describes providers, account data, legal requests, and user rights. There is no self-serve DPA today, so contact support@filepost.dev before using FilePost for a workflow that requires a processor agreement or special regulatory controls.