Security & Encryption Policy

Encryption Standards

We implement industry-standard encryption to protect your data at every level:

• HTTPS/TLS 1.3: All connections use TLS 1.3 encryption to protect data in transit between your device and our servers.
• Password Hashing: All passwords are hashed using bcrypt with salt rounds of 10, making them irreversible and secure.
• Storage Encryption: Data is stored in encrypted MongoDB databases with GridFS for file storage, ensuring data at rest is protected.
• Data in Transit: All API communications are secured via HTTPS, preventing man-in-the-middle attacks.

Logging Policy

We maintain transparent logging practices to ensure both security and privacy:

What We Log

• Hashed IP addresses (SHA-256) for rate limiting and abuse prevention
• Timestamps of actions (create, retrieve, download) for analytics
• Action types (view, click, download) for usage statistics
• Error logs for debugging and service improvement

What We Don't Log

• Full IP addresses (only hashed versions are stored)
• Content of URLs, clipboard text, or file contents (except for storage)
• Passwords are never logged, only stored as bcrypt hashes
• Personal information beyond what's voluntarily shared

Security Audits

We conduct regular security reviews and maintain audit trails:

• Code Review: All code changes undergo peer review before deployment to production.
• Dependency Scanning: Automated vulnerability scanning of all npm dependencies using npm audit and Dependabot.
• Security Headers: Implementation of comprehensive security headers including CSP, HSTS, X-Frame-Options, and more.
• Penetration Testing: Regular security testing to identify and fix vulnerabilities before they can be exploited.

Infrastructure Security

Our infrastructure is built with security as a priority:

• Secure Hosting: Hosted on enterprise-grade infrastructure with DDoS protection and firewall rules.
• Database Security: MongoDB with authentication, authorization, and encrypted connections. TTL indexes for automatic data expiration.
• CDN & Bot Protection: Cloudflare CDN with local image CAPTCHA to prevent abuse and ensure service availability.
• 24/7 Monitoring: Real-time monitoring of service health, error rates, and security events.

Data Retention & Deletion

We implement automatic data deletion to minimize data retention:

• Short links: Optional expiration (or retained until deleted)
• Clipboard content: 1-168 hours (user-defined)
• Files: 1-24 hours maximum retention
• Analytics: Aggregated data retained for 90 days, individual events deleted after 30 days

Incident Response

In the event of a security incident, we have procedures to respond quickly: immediate investigation, containment of the issue, notification of affected users if necessary, and post-incident analysis to prevent future occurrences.

Compliance & Best Practices

We follow industry best practices and comply with relevant data protection regulations. Our service is designed with privacy-by-design principles, minimizing data collection and maximizing user control.

Security Contact

If you discover a security vulnerability, please report it responsibly through our website. We appreciate security researchers and will acknowledge your contribution.