Secure by default, honest about the rest
Last updated: effective immediately
Share2Us is built to move a file from one place to another and then get out of the way, not to be a long-term vault or a public host. That shapes every decision below. Where a control genuinely protects you, it is on by default. Where we cannot make a promise, we tell you plainly instead of implying one.
Links give nothing away
A public link is an opaque, random identifier. It never encodes the filename, the owner, a database ID, a storage path, or a timestamp, so a link cannot be guessed, enumerated, or reverse-engineered into anything about you or your account. Every share carries an expiry and can be revoked the moment you are done, ending access automatically or on demand.
You decide who gets in
A share can be restricted to named recipients or to an entire email domain, protected with a password, or made to open exactly once. Recipient-restricted links are safe to hand-deliver: the person still has to prove the matching identity before anything is served.
End-to-end encryption
The command-line client can encrypt a file on your machine before it is ever uploaded. In that mode we only store ciphertext, so we cannot read it, and neither can anyone who intercepts the link.
Prohibited content is handled on report
We do not proactively inspect the content of your files, consistent with the privacy posture above. Prohibited material (illegal content, and CSAM in particular) is barred by the Acceptable Use terms and handled on report: takedown, IP banning, and preservation of evidence where the law requires it.
Every download is authorized
Downloads never stream through a public bucket. Each one passes an authorization check first, then redirects to a short-lived, narrowly-scoped storage URL. Files are served as attachments with X-Content-Type-Options: nosniff, so a browser will not run uploaded content inline as active web content.
Accounts and access
Sign-in is via Google SSO today, with more SSO providers coming soon. There is no password database to breach, and automated sign-ups are kept out. Command-line and automation credentials are individually scoped, revocable, and audited, and every action taken on your account is logged so access is visible rather than mysterious. Operator access to the admin console is role-based and least-privilege.
Open source, so you can verify
The client is open source. You never have to take the claims on this page on faith. You can read exactly what runs on your machine before you trust it. That is the point: security you can check beats security you are asked to believe.
See for yourself: share2us/cli (the command-line client) and share2us/cli-core (its shared core library).