Security

How TransferSize protects access and reduces delivery risk

Security is a set of boundaries, not a badge. TransferSize uses HTTPS endpoints, retryable upload integrity checks, derived transfer passwords, session controls, and narrowly scoped WebDAV credentials; senders still decide who gets a link and what a recipient may do after download.

Try the real sender See how it works ↓

TSverified path

01TLS requestProtected
02Hashed password gateEnabled
03Expiring signed accessScoped

01HTTPSRequired for public service transport

02PBKDF2-SHA-256Transfer-password derivation

03Read-onlyCurrent WebDAV permission model

Trust01

Transfer passwords

Passwords are processed using PBKDF2-SHA-256 with a random salt and 210,000 iterations. They gate the transfer but are not client-side end-to-end encryption of the uploaded bytes.

Trust02

Upload integrity and availability

Multipart parts carry integrity information, retries are idempotent, and finalization checks the completed byte count. These controls reduce accidental corruption; they do not make any internet service infallible or replace your backup.

Trust03

Account and app credentials

Account sessions are separated from public recipient pages. WebDAV uses revocable app passwords that are displayed once and retained as a digest, and entitlement is rechecked.

Trust04

Your side of the boundary

Confirm recipient identity, use a different channel for passwords, choose short practical expiries, revoke unneeded links and credentials, maintain source backups, and report suspicious behavior to support@transfersize.com.

Edge cases

Before the handoff

Is TransferSize end-to-end encrypted?

Do not assume client-side end-to-end encryption. HTTPS protects transport and access controls gate delivery.

Can a download be recalled?

You can close future access, but a file already downloaded may have been copied.

How do I report a vulnerability?

Email support@transfersize.com with reproduction details and avoid accessing data that is not yours.