Security

Files go straight to storage

When you upload or download with the website, the CLI or the SDK, the file travels between your device and storage directly. FileFreak's servers give your device a signed address for it, and never handle the file itself.

A signed address works for a short time only: 15 minutes to start a download, 4 hours for audio and video, so that a player can keep fetching as you skip about, and at most 30 minutes for each part of an upload. Until then it works for anybody who has it, as a key does.

An upload is written to a place of its own and copied into place when it is finished, so no address FileFreak gives out can change a file once it is kept.

Where files are kept

Files, and the database that says what and where they are, are kept in Microsoft Azure, in its East US 2 region. Azure encrypts both on its disks with keys Microsoft manages, and both take only encrypted connections.

Each file is kept as three copies in one datacentre. There is no copy in a second region, and a file deleted for good cannot be brought back.

This is not end-to-end encryption. FileFreak's own systems can read what is stored, and do, to make the small pictures shown for images.

Kept apart from the site

A file is never served from filefreak.io itself. Its bytes come from storage's own address, so a file cannot act as the site, or as you.

In the browser, documents open inside a frame that cannot reach your account. Web pages and SVG images are never shown, only downloaded.

The site's pages cannot be shown inside another site's page, and browsers are told to reach it over an encrypted connection only.

Signing in

Your password is kept only as a scrypt hash, which cannot be turned back into the password, and it must be at least 10 characters. Long beats complicated: there is no rule about symbols.

Guessing is slowed down: after 8 tries at one account in 15 minutes, or 30 from one network address, signing in is refused until the time has passed.

You can add a second factor: an authenticator app, or a code sent to your email, with recovery codes for when you have neither. A browser can be remembered for 30 days. Nobody can use FileFreak's administration without a second factor.

A sign-in lasts 30 days. Sign out everywhere, in Settings, ends it in every browser and every sign-in from the CLI at once, and so does changing your password. Settings can also email you each time you sign in.

The second factor guards signing in: changing it, or deleting your account, asks for your password instead. Keys made for programs are not ended by signing out everywhere; each is revoked on its own. Passwords are not checked against lists of leaked ones, and passkeys are not offered.

Keys for programs

A key for the developer API is shown once, then kept only as a hash. It can be limited to reading, to one folder and to an end date, and it reaches only its own app's storage.

A key sent from a web page is refused, so that no key is left in a page's code for anybody to copy. A page is given a token that ends soon in its place.

The CLI signs in with a code that you approve in the browser. A sign-in like that can do what you can, except pay for anything, manage keys or approve another sign-in, and each can be signed out on its own in Settings.

A key works for whoever holds it, until it ends or is revoked.

Sharing

A link is the key to what it shares: anybody who has it can open it. It can have a password, an end date and a limit on how many times it is downloaded, and turning it off takes effect at once. Guesses at a link's password are limited. A link to a folder reaches only what is inside that folder.

Before its password is given, a link shows the name of what is shared and who shared it. A public address does not end. Files are not scanned for viruses: a file shared with you is as safe as whoever shared it.

What FileFreak can see

No tool FileFreak's administrators have opens or downloads your files, and none lets them sign in as you.

They can see an account's email address, username and plan, and the names, sizes, types and folders of its files, which is what answering a question or a report needs. What they change, and every question they ask of the database, is written to a log with who did it.

These are rules FileFreak keeps, not a wall: the systems your files are on are FileFreak's to run.

Deleting

Something you delete waits in the trash for 30 days, then is removed for good. Removing it for good deletes its bytes from storage shortly after, and they cannot be brought back. Deleting your account, which asks for your password, removes everything in it the same way.

The database's backups, which hold names and sizes but never a file, are kept for 14 days, and storage keeps its own record of requests for 60 days.

Reporting a problem

If you find a way to reach what you should not, please tell us through Support, choosing A security problem, before telling anybody else. A person reads every message. Please try it only on your own account and files.

Programs that look for where to report find the same at /.well-known/security.txt.