Security
How your files are protected
What happens to a file from the moment you upload it, written down plainly, including what we do not do.
From your device to storage
Encrypted before it is stored
Files are encrypted by the service before they reach the disk or object store, and every step on the way is authorised and checked.
- You connect over TLS. Traffic between your device and the service uses TLS 1.2 or 1.3. Older protocol versions are not accepted.
- Every request is authorised. The service checks who you are and whether you may do this particular thing, each time. Nothing is allowed because an earlier request was.
- The file is sealed in segments. It is cut into 1 MiB segments and each one is encrypted with AES-256-GCM, which also detects any change made to the stored data.
- Each file has its own key. A random data key is created per file and is itself encrypted with a master key that lives in the server’s configuration, never next to the files.
- Only ciphertext is stored. What reaches the storage pool, a local disk or any S3-compatible service, cannot be read without those keys.
- Integrity is checked. A SHA-256 fingerprint is recorded for every file, and a scheduled job re-reads a sample of stored files each week and compares them with it.
Your account
Protecting the way in
Strong storage does not help if someone can simply sign in as you.
Passwords that hold up
Passwords are stored as Argon2id hashes and weak ones are refused when you choose them. We never keep the password itself.
Two-factor authentication
Add an authenticator app to your account and keep a set of one-time recovery codes for the day you lose your phone.
Sign-in protection
Repeated wrong passwords lock the account for a while, and the lock grows longer if the attempts continue. Requests from one address are limited too.
Sessions you can see
Every browser, app and computer that is signed in is listed in your settings. Sign any of them out, or all but this one.
Alerts for new devices
When the desktop app or a mobile app signs in on a new device, you get a notification and an email.
Tokens that rotate
Sign-in tokens are short-lived and are replaced each time they are used. If an old one is presented again, the whole session is ended.
Sharing
Sharing that you can take back
A link is only as safe as your ability to close it.
Links with limits
A link can have a download limit and can be disabled at any time. Where your plan includes them, links can also need a password and expire on a date. The password is stored as a hash.
Access follows the folder
People you share with get exactly the role you chose, viewer or editor, and it applies to what is inside a shared folder as well. Remove them and it ends.
Malware scanning
Uploaded files are scanned in the background. A file that is found to be infected is quarantined: it can no longer be downloaded or shared, and its owner is notified.
Honest limits
What this does not mean
Your files are not end-to-end encrypted. Encryption happens on the server, so the service holds the keys. That is what allows previews, search by file name, share links and recovery to work. If you need files that even the service cannot read, encrypt them on your own computer before you upload them.
This page describes how the software works. It is not an audit report, and it lists no certifications.
Nothing replaces your own care. A weak, reused password or a link sent to the wrong person is still a risk. Turn on two-factor authentication, and use passwords and expiry dates on links to anything sensitive.
Reporting
Found a security problem?
Please tell us privately before you tell anyone else. Use the contact form or write to support@iglubox.com, and include the steps to reproduce it. Our contact details for security reports are also published in security.txt.