Security practices

API keys & domain binding

Paid keys are created in your dashboard and validated online. Keys are bound to registered website domains so a leaked key is harder to reuse on another origin.

Bring-your-own storage

With BYO plans, AWS credentials, Azure, or GCS secrets never leave your proxy. The browser SDK talks to your origin over HTTPS using the documented HTTP or S3-proxy contract.

Managed storage

Managed plans provision isolated prefixes on our AWS footprint. Access is scoped to your account; usage feeds billing pools shown in the console.

Transport & sessions

Dashboard auth uses industry-standard session tokens and optional Google Sign-In. We force HTTPS on filestorage.io and related hosts.

Report a vulnerability

Email [email protected] with steps to reproduce. Please give us a reasonable window before public disclosure.

Related: Privacy Policy · Terms of Service