How Dropvi protects your files

• •Each transfer gets a new random key, made in your browser or by the command-line tool. Files and their details are encrypted with AES-256-GCM using keys derived from it.
• •Dropvi stores only the encrypted data. Cloudflare, which stores it, also encrypts stored files and our database at rest with AES-256.
• •Uploads, downloads and sign-in requests travel to our API over HTTPS, which encrypts them in transit with TLS.

• •The key is part of the share link, after the # sign. Browsers do not send that part of a link to Dropvi. The one exception is sending by email: your browser or the command-line tool gives Dropvi the key when the upload finishes, so that the email can carry the full link. Dropvi uses it only for that email and does not store it.
• •Anyone with the full link can open the transfer until it expires. Without the key, the download page shows the number and size of the files, the expiry date, the download count and limit, and the sender’s branding if they have a workspace, but no file names or contents.
• •On every plan you can add a PIN, which also becomes part of the key, so the link alone is not enough to open the files.
• •When you send from the website, your browser keeps each transfer’s key in its own storage so that your dashboard can show the file names. This stored copy never leaves your browser.
• •If you lose the key, Dropvi cannot recover it.

Files sent to you through a request link are encrypted in the sender’s browser for your receive key. Your browser makes that key (X25519) when you set up request links and keeps it in a form scripts can use but cannot read; you save a backup file of it, sealed with a passphrase, before your first link opens. Each upload agrees a fresh key with yours, from which the files, their names and the sender’s message are encrypted with AES-256-GCM as for any transfer. The key the upload page encrypts for is the one in the link you shared, after the # sign, and the page refuses a link without it. Only your signed-in account can download the files. Dropvi never receives the private key, the backup or the passphrase, so it cannot recover them: if every copy and the backup are lost, or the passphrase is forgotten, the files sent to that key cannot be opened by you or by Dropvi.

Dropvi holds, and can see:

• •the public half of your receive key and its key ID, including keys you have replaced;
• •each link’s title, message and the name people sending files see, its limits, whether it is open, and its dates;
• •for each upload, which link it came through, the number and encrypted sizes of its files, when it started, finished and expires, how often it was downloaded, and the public key the sender’s browser made for that upload alone;
• •for a link of an account on the free plan, a keyed hash of the network each upload came from, kept for 25 hours for the upload limits;
• •as for every request, the sender’s IP address in our request logs, and the result of the Turnstile check.

It cannot see the files, their names or types, their checksums, or the name and message the sender typed. This depends on the code dropvi.com sends to the browsers involved, as the limits below explain.

Dropvi can see

• •Recipients’ email addresses, because Dropvi sends the emails. When you are signed in, they are also saved to your account’s saved recipients until you remove them, turn saving off or delete your account.
• •The number of files, their sizes, and when the transfer was created, finished uploading, expires and was deleted, because Dropvi needs them to deliver and delete transfers.
• •Which account sent a transfer, if you were signed in or added it to your account later, its email address, and the settings you chose, such as the expiry and any download limit.
• •For each download or preview: the time, the country Cloudflare associates with the connection, the browser’s user agent and a keyed hash of the IP address.
• •Where a transfer came from: the link label in the address you arrived at, or the domain of the website that linked to Dropvi, never the address of the page.
• •For a branded workspace: its subdomain, name, logo, headline and colours, which anyone can see on the workspace.

Dropvi cannot see

• •The files themselves.
• •File names and types, the title, the message and the sender name.
• •The key, which is in the link after the # sign, except while Dropvi sends a transfer by email, or when someone gives Dropvi the full link, for example in the optional Full link field of a report.

The privacy notice lists everything Dropvi records. Because Dropvi cannot see what a transfer contains, it does not scan files. Reports of misuse are handled as theterms of service describe.

A server can only scan a file for viruses if it can read the file, and end-to-end encryption means Dropvi’s servers cannot. Instead, once the recipient’s browser has decrypted the file names, the download page marks file types that can run programs or macros, such as .exe, .js, .dmg or .docm files, and says to open them only if you trust the sender. It does not block the download, and it does not look inside the files.

• •Dropvi receives a PIN or password when you set it and when a recipient enters it, and stores it only as a hash. New PINs and passwords are hashed with salted PBKDF2 (SHA-256, 100,000 iterations). Ten wrong attempts lock the transfer for 15 minutes.
• •On paid plans you can also set a download limit.
• •Upload keys and deletion keys are stored only as SHA-256 hashes. Sign-in codes are stored as keyed hashes, and the IP addresses in our download and report records only as keyed hashes.

• •You sign in with a one-time code sent to your email address. Before a code is sent, the sign-in form runs a Cloudflare Turnstile check, and our API sends no code if the check fails or cannot be confirmed with Cloudflare.
• •To slow down misuse, Dropvi counts recent requests over one-minute periods: by IP address (for IPv6, each /64 network), by email address for sign-in, and by account for transfers and replies sent while signed in.
• •Sending a transfer without an account runs a Cloudflare Turnstile check too, and our API creates no transfer if the check fails or cannot be confirmed with Cloudflare.
• •Without an account, or on the free plan, up to 100 GB can be uploaded from one network (an IP address, or for IPv6 a /64 network) in any 24 hours, and up to 300 GB from one IPv6 /48 network. Paid plans are not limited by these.

• •The sender chooses when a transfer expires: from 1 to 7 days on the free plan, or up to 365 days on a paid plan. Its files are deleted from storage at the first hourly clean-up after it expires.
• •Revoking a transfer deletes its files straight away. You can revoke from the dashboard when signed in, or from the browser you sent it from without an account.
• •The record of a transfer, without its files, is deleted 365 days after the transfer ends, unless a report about it is still open. The privacy notice lists how long everything is kept.

The website runs code that dropvi.com sends to your browser, so this protection depends on that code: code changed at dropvi.com could send keys elsewhere. If you prefer not to rely on that, theDropvi command-line tool encrypts and decrypts on your own computer, at the version you install.

Anyone you give the full link to, or who finds it, can open the transfer until it expires or you revoke it, unless it has a PIN or password.

If you find a security problem in Dropvi, email info@dropvi.comwith the details.