Careful with your files

Here's exactly what we do to keep your transfers private, and where the limits are. No buzzwords.

Encrypted in transit: Every upload and download travels over TLS (HTTPS). Files go straight from your browser to storage, using upload links that expire after a short time.
Private storage in Frankfurt: Files are kept in a private bucket on Linode (Akamai) Object Storage in Frankfurt, Germany. Nothing in it is public.
Short-lived download links: When someone downloads, we create a signed link that only works for a short time. Passing it around later gets nobody anywhere.
Password-protected transfers: On Ultimate and Teams you can add a password to a transfer. We only store a bcrypt hash of it, never the password itself.
Download limits that hold: Download limits are counted atomically, so two downloads at the same moment can't sneak past the limit.
Automatic deletion: When a transfer expires, its files are deleted automatically. Uploads that were never finished are cleared out after 24 hours.
Verified senders: Sending without an account? We email you a 6-digit code first. Nothing is delivered until you enter it.
Rate limits: Sign-in, verification codes and downloads are rate-limited to slow down guessing and abuse.
Two-factor for admins: Access to our admin panel requires two-factor authentication.
No trackers: No analytics, no advertising trackers, essential cookies only. Download records store a keyed hash of the IP address, not the address itself.

Where the line is

MoveMyFiles doesn't offer end-to-end encryption. If your files need that level of protection, encrypt them before you upload and share the password another way.

Found a security issue?

Please tell us. Email security@movemyfiles.com with what you found and the steps to reproduce it.

Our security contact details are also published at /.well-known/security.txt.

While you look around

Only test against your own account and your own transfers.
Don't access, change or delete other people's data.
Don't run tests that slow the service down for everyone else, like denial-of-service attacks or spam.
Give us reasonable time to fix the issue before you share it publicly.

We read every report and will get back to you.