Security
How Send Atlas protects your files, and what it doesn’t do yet.
A plain account of how files are encrypted, stored and shared, so you can decide what to send. No vague “military-grade” claims.
Encrypted before upload, and in transit
- In your browser, before upload. Each file is encrypted with AES-256-GCM, a fresh key per file, before any bytes leave your computer. What Send Atlas stores is the encrypted file.
- In transit. Every connection to Send Atlas and to storage uses TLS (HTTPS).
- Keys are held by Send Atlas. The file key is stored with the transfer so a recipient can open it from a link, with no separate key to pass along. This is not end-to-end or zero-knowledge encryption: Send Atlas could technically decrypt a file.
- Released only after the checks pass. The key and the file are only handed to a downloader after the link’s password, expiry, download limit and recipient checks pass.
Where your files live, and for how long
- Files are stored in Cloudflare R2, in one storage location. They are not replicated to a second region.
- Transfer records (file names, sizes, dates, download history) are stored in Amazon DynamoDB in the US East (N. Virginia) region.
- Free transfers are deleted when the link expires.
- Pro files stay in Active Storage until you delete them. A file with no downloads for 45 days is deleted automatically.
- Delete any time. Deleting removes the file from storage. The record of the transfer stays in your history, marked deleted.
- No scanning, no AI training. Send Atlas doesn’t open, analyze or sell your files, and never uses them to train AI.
Who can open a transfer
- Passwords. Optional on every transfer. Stored as a salted PBKDF2-SHA256 hash, never as the password itself, and repeated wrong guesses are rate-limited.
- Expiry and download limits. Set how long a link works and how many times it can be downloaded. Close a link early at any time.
- Personal recipient links Pro. Each recipient gets their own link. You can turn off one person’s link without affecting anyone else, and you can make the transfer open only from those personal links.
- Delivery receipts Pro. When a recipient downloads, you get a certificate with the time, approximate location, IP address and device. Locations come from the network and are approximate.
- Pro features are enforced on our servers, not just hidden in the app.
Sign-in and billing
- Sign-in is handled by Clerk. Send Atlas never sees or stores your password.
- Payments are handled by Stripe. Card details go to Stripe and never touch Send Atlas servers.
- Email (download links, receipts) is sent through Resend.
What Send Atlas doesn’t offer yet
Being straight about the gaps: no end-to-end or zero-knowledge encryption, no TPN, SOC 2 or ISO 27001 certification, no choice of storage region, no single sign-on (SSO), and no malware scanning of uploads. Send Atlas is run by one person, so there is no dedicated security team. If any of those are requirements for a title, a studio-certified service is the right call for now.
Found a security problem? Email support@send-atlas.com with the details, and please give us a chance to fix it before sharing it publicly.
Security FAQ
Is Send Atlas end-to-end encrypted?
No. Files are encrypted in your browser with AES-256-GCM before they upload, but Send Atlas keeps the key so your recipient can open the file from a plain link. That means Send Atlas could technically decrypt a file. We say so plainly so you can decide what to send.
Where are my files stored?
Files are stored in Cloudflare R2. Transfer records (file names, sizes, dates, download history) are stored in Amazon DynamoDB in the US East (N. Virginia) region. Files are not copied to a second region.
Do you scan my files or use them to train AI?
No. Send Atlas doesn't open, scan, analyze or sell your files, and never uses them to train AI.
How long do you keep my files?
Free transfers are deleted when the link expires. On Pro, files stay in Active Storage until you delete them, and a file with no downloads for 45 days is deleted automatically. A record of the transfer (names, sizes, dates and downloads) stays in your history after the files are gone.
Is Send Atlas TPN certified?
Not yet. Send Atlas doesn't hold TPN, SOC 2 or ISO 27001 certification today. If a studio requires one of those for a title, check before you send.
How do I report a security problem?
Email support@send-atlas.com with the details. You'll hear back from the person who builds Send Atlas.
Send with the details in the open.
Free up to 15 GB per transfer, no card required. Flat $14.99/mo for up to 1 TB with personal links and delivery receipts.