Security

Every file upload goes through a validated pipeline: size check → MIME type check → magic-byte validation → format-specific structural check → isolated worker processing → temporary output storage → short-lived download token generation.

Uploads, processing jobs, and downloads are handled by separate components with least-privilege access. Worker processes do not have direct internet access or access to other users' data.

All data in transit is encrypted using TLS 1.2 or higher. HTTPS is enforced on all pages and API endpoints; HTTP requests are automatically redirected.

Files at rest are stored on encrypted volumes. Encryption keys are managed by our cloud infrastructure provider.

Files are validated before processing using file size limits, MIME type checks, file extension checks, and magic-byte inspection. Files that fail validation are rejected immediately and not processed.

Processing runs in isolated, ephemeral worker processes. Workers do not retain state between jobs and are discarded after a job completes or times out.

Generated download links are single-use tokens tied to a specific job output. They cannot be guessed or enumerated.

Account passwords are hashed using a strong one-way algorithm (bcrypt). Plain-text passwords are never stored or logged.

Authenticated API requests require a valid API key sent over HTTPS. API keys can be revoked from your account settings at any time.

Administrative access to infrastructure requires multi-factor authentication and is restricted to authorised personnel only.

Uploaded input files and processed output files are automatically deleted within 60 minutes of upload. This is enforced by scheduled cleanup jobs, not just link expiry.

When you delete your account, your account data, job history, and any associated personal information are permanently removed within 30 days.

Anonymised, aggregated usage logs may be retained for longer periods for abuse prevention and service improvement.

Rate limiting is applied per IP address and per account to prevent automated abuse. Requests that exceed limits are rejected with informative error messages.

Errors returned to users are sanitised and do not include stack traces, internal file paths, database error details, or other sensitive infrastructure information.

We monitor for unusual patterns, large-scale scraping, and repeated failed authentication attempts. Suspicious activity may result in temporary or permanent access restrictions.

We rely on infrastructure providers that maintain SOC 2 or equivalent security certifications. Data-processing relationships are governed by data-processing agreements.

Stripe handles all payment processing and is PCI DSS Level 1 certified. We never receive or store raw card numbers.

Open-source libraries used in the processing pipeline are reviewed and updated regularly. Known vulnerabilities in dependencies are patched promptly.

If you discover a security vulnerability in One Big File, please report it responsibly to onebigfile@gmail.com with a clear description of the issue, steps to reproduce it, and any relevant request IDs or screenshots.

Please do not access, modify, download, or share data that does not belong to you while investigating a potential vulnerability.

We will acknowledge your report within 3 business days and aim to resolve confirmed vulnerabilities within 30 days. We currently do not operate a formal bug bounty programme, but we do appreciate responsible disclosure.