Security

We never touch your files

Bytes travel directly from your own cloud bucket to your client. We generate time-limited access links from your credentials, but the file itself never passes through, and is never stored on, our servers.

• Your file contents — bytes travel directly from your own bucket to your client; no file byte passes through our servers.
• No second copy of your connected-bucket files in our infrastructure — we are never part of your file-custody chain.

Your file bytes transfer directly from your storage to your recipient and never pass through VaultFerry or your automation tool. Link metadata you route through an automation (filenames, labels, expiry) does pass through VaultFerry and that tool.

What we store

We store only the metadata required to operate the service, plus any branding assets you upload:

• File names, sizes, and the object path (key) of the files behind the links you create.
• Access timestamps and success/failure for each download and confirmed upload.
• The approximate region of an access — the country — derived from the IP and stored on the access record on Pro and Business plans (left empty on Free). The raw IP itself is never stored by our application; infrastructure providers (see the sub-processor registry) may process it in transit.
• A salted, non-reversible hash of the accessing IP — never the IP itself.
• The browser User-Agent string of a download access.
• For file requests (upload links), any name and email address the uploader provides — required when you enable “Require uploader identity”.
• Your cloud credentials, encrypted with AES-256-GCM and decrypted in memory only, never logged.
• For API keys (Business plan): the name you give each key, a one-way hash of the key — never the key itself — and a short display prefix so you can recognise it in a list. Revoke a key any time; revoked keys stop working immediately and are erased after 30 days.
• Branding assets you upload on the Business plan — logo image, company name, accent colour — stored in a VaultFerry-managed storage bucket listed in the sub-processor registry.

Encryption

The following measures are committed contractually in our Data Processing Agreement.

• Cloud credentials are encrypted at rest with AES-256-GCM and decrypted in memory only, at the moment a link is minted.
• All traffic is served over TLS 1.2+.
• Share-link passwords are hashed with bcrypt (cost ≥ 12) and are never stored or returned in plaintext.
• API keys are verified against a one-way SHA-256 hash; the full key is shown once at creation and never stored.
• Account sign-in is handled by Hanko; we never hold your account password.

Link security

Download links are backed by short-lived, signed URLs minted fresh on each download — they expire up to 5 minutes after they are issued. For full transparency: revoking a link in the dashboard stops new links being minted, but a signed URL already handed out remains valid until it expires (at most 5 minutes).

For large downloads on paid plans, an interrupted transfer can refresh its link within a bounded session window (up to 6 hours) so it can resume without counting as a new download — each refreshed URL still expires within 5 minutes, and revoking the link stops any further refreshes immediately.

Sub-processors

We rely on a small set of sub-processors for metadata and operations. File bytes never reach any of them. The full list and the terms that bind them are set out in our Data Processing Agreement.

• Vercel Inc. — Frontend application hosting and edge network — serves the web application and processes operational metadata; never the contents of your connected storage buckets. Processing location: United States (global edge network)
• Railway Corp. — Backend application hosting and managed PostgreSQL metadata database — runs the VaultFerry API and stores the operational metadata and encrypted storage credentials described in the DPA; never the contents of your connected storage buckets. Processing location: United States entity; deployment region: Amsterdam, Netherlands (EU)
• Cloudflare, Inc. — Reverse proxy, CDN, and TLS termination for the API domain — processes request content and connection IP addresses in transit; never the contents of your connected storage buckets. Processing location: United States entity; global edge network
• Amazon Web Services EMEA SARL — Object storage (S3) for the branding assets you upload (logo images) only; never the contents of your connected storage buckets. Processing location: London, UK — eu-west-2
• Hanko GmbH — Managed authentication (sign-in, account identity). Processing location: Frankfurt, Germany (EU)
• Resend, Inc. — Transactional email — download and upload notifications and subscription confirmations. Processing location: United States
• Stripe, Inc. — Subscription billing and payment processing. Processing location: United States (payments processed globally)
• Better Stack, Inc. — Application log aggregation, error alerting, and uptime monitoring — processes pseudonymised operational metadata (request id, pseudonymous account identifiers, and — for API-key usage and lifecycle events — an internal key identifier plus the key's non-secret display prefix, never a key's name or secret); never the contents of your connected storage buckets. Processing location: United States entity (Delaware); log-data region: Germany (EU)

Incident response

On becoming aware of a security incident affecting your data, we commit to notifying you within 72 hours — supporting the service-provider oversight expectations of SEC Regulation S-P. These commitments are set out in full in our Data Processing Agreement.

Shared responsibility

Because your files live in your own cloud account, your bucket’s access controls are yours to set. We provide a connection test and a setup checklist, but we cannot enforce your bucket’s permissions. We recommend blocking public access, enabling server-side encryption, and turning on access logging.

For law firms

Because file contents never leave your own infrastructure, VaultFerry supports the “reasonable efforts” standard of ABA Model Rule 1.6(c) and Formal Opinion 477R for your file contents. We do store a limited set of operational metadata — file names, sizes, and paths — as disclosed in our Data Processing Agreement. VaultFerry is a tool that supports your compliance program; it is not by itself a guarantee of regulatory compliance.

For financial & accounting firms

Keeping client files in your own bucket supports SEC Regulation S-P’s safeguarding and service-provider oversight requirements: your files stay under your control — we hold only limited operational metadata, described in our DPA — and our 72-hour breach-notification commitment supports your own incident-response program.

A note on session cookies

Our authentication cookie is set by Hanko’s browser SDK and is readable by first-party JavaScript on our origin. We constrain that surface with a strict Content-Security-Policy (script nonces plus strict-dynamic) on every page; script and style rules are never relaxed. Sign-in and app pages additionally permit network connections to our authentication provider, and billing pages to Stripe. The full list of cookies and local storage is in the Privacy Policy. Separately from browser sessions, the API (available on the Business plan) authenticates with per-account API keys sent in a request header; an API key cannot be used to create or manage other keys.