Security¶

Security pages often promise more than the product does. This one states what Velravio protects today, so you can decide what to store here. For past issues, see the security advisories.

In transit¶

All traffic runs over HTTPS. A gateway in front of the application terminates TLS 1.2 and 1.3, redirects plain HTTP to HTTPS and sets HSTS. Between your device and the zone, the connection is encrypted.

At rest on our disks¶

Plainly: Velravio does not encrypt file contents at rest. Your files are written to the zone's storage volume as ordinary files, named by a random identifier rather than by your file name. We do not offer client-side or zero-knowledge encryption, and we can read the files to operate the service.

If a file must be unreadable to the people who run the storage, encrypt it yourself before upload. Velravio stores and returns your encrypted bytes unchanged, and the SHA-256 lets you confirm they came back intact.

So you know

We would rather lose a sign-up than have you assume an encryption guarantee we do not make. If at-rest encryption becomes available, it will be announced on the changelog, not quietly implied here.

Passwords¶

Passwords must be at least 10 characters. We store them with a slow hash (scrypt, with a per-password salt) and never in plain text. Five wrong attempts on one email pause sign-in for that email for 15 minutes.

Sessions and API tokens¶

A browser session is a cookie with the __Host- prefix, set Secure, HttpOnly and SameSite=Lax. State-changing requests from the browser also carry a CSRF token. You can list and end active sessions from the console. API tokens are shown once, at creation; we store only their SHA-256, so a leak of our database does not reveal usable tokens.

A share link is a random token in the URL. You choose how long it lives (1 hour to 30 days) and can require an access code, stored as a slow hash. The link counts downloads and expires on its own.

Reporting a problem¶

Found a vulnerability? Tell us through the contact form with enough detail to reproduce it. Our security.txt is at /.well-known/security.txt. Please do not run tests that affect other accounts or delete other people's data.