Security Practices

At SnapTransfer, the security and privacy of your data are fundamental to our architecture. We believe that you should have absolute control over your files. That is why we have engineered SnapTransfer to minimize data exposure, protect your transfers with industry-standard cryptography, and establish zero-knowledge storage models.

01Peer-to-Peer (P2P) Transfers

By default, SnapTransfer facilitates direct file transfers using WebRTC (Web Real-Time Communication) technology. This means your files stream directly from browser to browser.

• Direct Routing: WebRTC establishes a direct connection between the sender and recipient, meaning data does not pass through, get copied on, or touch our application servers.
• DTLS/SRTP Encryption: Direct data channels are fully encrypted using Datagram Transport Layer Security (DTLS) and Secure Real-time Transport Protocol (SRTP). This ensures that even signaling intermediates cannot intercept or view the data payload.
• Secure Signaling: The connection handshake (negotiating candidate IP addresses and session description protocols) occurs over a secure WebSocket channel protected by TLS encryption.

02Hosted Storage (Offline Transfers)

If you choose to use our hosted cloud transfers (for when a recipient is offline, or if you prefer a persistent link), we apply robust encryption to ensure your files remain private while on our infrastructure.

• Encryption in Transit: All uploads and downloads to and from our temporary servers use HTTPS (HTTP over TLS 1.3/1.2), preventing interception during transmission.
• Encryption at Rest: Files stored on our secure cloud buckets are immediately encrypted using AES-256 (Advanced Encryption Standard with a 256-bit key), the industry standard for high-security environments.
• Automated 24-Hour Self-Destruct: To enforce automatic expiration, all hosted files are automatically and permanently deleted from our servers within 24 hours of creation, or immediately when the sender chooses to delete them manually. No backups or archives are retained.
• Zero-Knowledge Metadata: We store minimal file metadata. Filenames and sizes are stored securely solely to facilitate the transfer, and are cleared permanently when the file is deleted.

03Account & Auth Security

If you create an optional account to manage historical transfers or access additional benefits, we protect your credentials and sessions using modern authentication standards:

• Cryptographic Password Hashing: Passwords are never stored in plain text. We hash passwords using strong, computationally heavy hashing algorithms (such as bcrypt) with unique random salts, rendering brute-force attacks ineffective.
• Token-Based Authentication: Secure authentication sessions are maintained using securely configured HTTP-only and SameSite cookies or cryptographically signed tokens to prevent Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks.
• Rate Limiting: All authentication routes are protected by strict rate limiters to prevent automated brute-force attempts on credentials.

04Infrastructure & Network

SnapTransfer is hosted on high-availability, compliance-certified cloud platforms. We enforce rigorous network boundary protections:

• Firewalls & Intrusion Prevention: Our network boundaries are guarded by advanced web application firewalls (WAF) to intercept and neutralize common web vulnerabilities, DDoS attacks, and malicious payloads.
• Encrypted Internal Communications: Any communication between our services, microservices, and databases is TLS-encrypted, ensuring secure internal transit.
• Vulnerability Scanning: We conduct automated static application security testing (SAST) and software composition analysis (SCA) on our codebase to scan for dependencies with known security issues prior to deployments.

05Your Security Responsibilities

Security is a shared responsibility. While we protect the transmission channels and backend storage, please follow these guidelines to maximize your transfer safety:

• Protect Shareable Links: SnapTransfer shareable links are unique keys. Only share these links with intended recipients. Anyone with access to the link will be able to download the corresponding file while it is available.
• Use Strong Passwords: If you register an account, select a unique, strong password, and avoid reusing credentials from other online services.
• Verify Recipients: Double-check that you are sending links to the correct email address, messaging thread, or contact before initiating transfers.

06Vulnerability Disclosure

We welcome feedback and vulnerability reports from security researchers, white-hat practitioners, and our community. If you believe you have discovered a vulnerability, bug, or security concern in SnapTransfer, please help us protect our users by notifying us responsibly.

Please submit your report through our secure contact portal.

We ask that you do not publish the details of any suspected vulnerability until we have had reasonable time to investigate and patch the issue. We commit to acknowledging receipt of your report within 48 hours and providing updates on our remediation progress.