Security

How Filexco protects your data, what we can and cannot see, and where the limits are. This page describes how the system works. It is not a legal promise.

1. How we protect your data

Everything between your browser and Filexco travels over TLS. Files in standard folders are encrypted on our disks, with a separate key for each account and each file version. Access keys are stored encrypted and are never used as encryption keys.

2. Vaults and your master key

A vault is a whole bucket that is encrypted in your browser. File content, file names and file keys are encrypted with AES-256-GCM before upload. Sharing uses a hybrid of X25519 and ML-KEM-768, so shared keys are also built to resist future quantum computers. Your password never reaches us: your browser turns it into a login value and an encryption value with Argon2id, and only the login value is sent.

3. What we can and cannot see

Standard Storage is encrypted at rest with keys managed by Filexco, so our systems can process and deliver your files to WebDAV and the Filexco website. We do not routinely view your files, and access is limited to what operating and securing the Service requires. For vaults we see your email address, your plan, how many vaults you have and their encrypted names, the shape of your folder tree, file sizes, upload and download times and IP addresses. We cannot see file names, file content or keys.

4. Account security

Two-factor authentication with an authenticator app is available to every account and is required for administrators and resellers. Sessions use HttpOnly cookies and every change carries a security token. A password reset by email restores your login only. It never opens your vaults.

5. Known limits

The web app receives its code from our servers, so a compromised server could send harmful code. We reduce this risk with integrity checks on every script, a strict content security policy and pinned libraries, and we plan desktop and mobile apps. Our servers can see access patterns, sizes, folder shape and timing for vault files. If a malicious server swapped a person's public key, you would only notice by comparing fingerprints, which the app shows when you share.

6. Reporting a vulnerability

Please report security problems to [email protected]. The same address is published in our security.txt file. Tell us what you found, how to reproduce it and how we can reach you. Give us a reasonable time to fix the problem before you tell anyone else. We confirm that we received your report, keep you informed, and credit you if you wish.

We will not take legal action against people who test in good faith, stay within what we agreed, do not access or change other customers' data, and do not disrupt the Service. Do not run penetration tests or scans without our written permission; the Acceptable Use Policy has the rules.