Security
Where your files live
Uploads are stored in Cloudflare R2. Video is transcoded in Cloudflare Containers and streamed to viewers from that same storage. Application data — accounts, projects, comments, activity logs — is in Supabase (managed PostgreSQL). The app itself runs on Vercel. Payments are handled by Stripe, which is PCI-DSS certified; we never see or store a full card number.
The complete list of providers that touch data, and what each one does, is in Privacy Policy §7.
Encryption
- In transit: TLS on every connection — browser to app, app to storage, app to every provider.
- At rest: files in object storage and rows in the database are encrypted by the platforms that hold them.
- Passwords are stored only as salted hashes by our authentication provider, never in a form anyone can read — including us.
Who can reach your files
Two independent mechanisms, because accounts and share links are different problems.
- Accounts are isolated at the database level by row-level security. The rules are enforced by PostgreSQL itself rather than by application code, so a bug in a query cannot return another creator’s rows.
- File access is granted through signed, time-limited URLs generated per request. There is no permanently public URL to a stored file, so a link copied out of a network log stops working.
- Portals are reached by a share token, optionally protected with a password, an expiry date, and a download toggle you control per project.
Two limits worth being clear about
A share link is a key, not an identity check
Anyone holding a portal link can open it, which is what makes client review work without forcing your client to create an account — and it means a forwarded link works for whoever receives it. For sensitive deliveries, use the password, expiry and download controls. Crawlers are separately blocked from every delivery URL by our robots.txt.
Watermarking is a deterrent and a record — not forensic marking
The session watermark names the viewer on screen as they watch. It is an overlay drawn by the player: it is not embedded in the pixel data and does not survive re-encoding, so a determined viewer can remove it or film the screen. What it does is make a casual screen recording self-incriminating, and the activity log behind it — written server-side, not reachable from the browser — records who opened what, from where, and when, whatever the viewer does to the overlay. We do not claim it prevents leaks. See Terms §9.
Deletion and retention
- Deleting a project or file moves it to Trash, where it is recoverable for 30 days and is then permanently removed. Emptying Trash deletes immediately.
- Deleted data can persist in encrypted backups until they expire on their normal rotation, after which it is gone.
- We do not train AI models on your content, do not sell it, and do not use it for advertising.
- Full retention periods, per data type, are in Privacy Policy §9.
Keep your own master copies. FileSaurus is a delivery and review tool, not a backup service or an archive — Terms §4.
Reporting a vulnerability
If you have found a security issue, please tell us before telling anyone else. Email legal@filesaurus.com with “Security” in the subject and enough detail to reproduce it.
We will acknowledge within 3 business days, keep you updated while we fix it, and credit you if you would like. We will not pursue legal action against anyone acting in good faith under this policy: test only against your own account, do not access another user’s data, do not degrade the service for others, and give us a reasonable chance to fix the issue before publishing.
What we do not have yet
Being straight about this is more useful to you than a page of implied certifications. FileSaurus does not currently hold SOC 2, ISO 27001 or any third-party security certification, and is not set up to handle regulated data — no PCI cardholder environments, no HIPAA protected health information, no classified material. If your procurement process requires any of that today, we are not the right fit yet, and we would rather say so than have you find out during an audit.
Questions from a security or procurement review are welcome at legal@filesaurus.com.