Encryption
State-of-the-art encryption technologies protect your data at every level.
SendMeSafe uses multiple layers of encryption to protect your data during transfer and storage. All connections are encrypted with TLS 1.3, files are stored with server-side AES-256 encryption, and passwords are never stored in plain text but hashed with bcrypt. Additionally, we support end-to-end encryption for Connect Messenger (optional, when set up) and Flaschenpost messages, where only the participants can decrypt the content.
Security Features
TLS 1.3 Transport Encryption
All data transfers between your browser and our servers are encrypted with TLS 1.3 - the newest and most secure encryption standard for HTTPS connections.
AES-256 Storage Encryption
All uploaded files are secured with AES-256-bit encryption on our S3-compatible storage (Hetzner Object Storage) - the same standard used by banks and governments.
End-to-End Encryption
For Connect Messenger (optional, when set up) and Flaschenpost messages, we use true end-to-end encryption. Messenger uses X25519 (ECDH) and XSalsa20-Poly1305; Flaschenpost uses AES-256-GCM with PBKDF2 key derivation. Only the participants can decrypt the content.
Secure Password Hashing
All passwords are stored hashed with bcrypt (10 rounds). Even we cannot view your passwords - they are never stored in plain text.
Pre-signed URLs for Direct Upload
Files are uploaded directly to our storage without passing through our server. Each upload URL is signed and valid for only 5 minutes.
JWT Token Authentication
User authentication uses signed JWT tokens with secure session management. Tokens contain no sensitive data and are cryptographically protected.
Technical Implementation
Encryption During Transfer
As soon as you upload a file, the connection is secured with TLS 1.3. Caddy, our reverse proxy, automatically manages HTTPS certificates from Let's Encrypt.
Secure Upload Process
Your browser receives a signed pre-signed URL and uploads the file directly to encrypted S3 storage. The file never touches our application server unencrypted.
Token Validation
The upload link is verified: token validity, expiration date, optional password (bcrypt comparison), and organization status.
Pre-signed URL Generation
The server generates a signed S3 URL valid for 5 minutes. The URL contains cryptographic signatures for authorization.
PUT https://s3.eu/bucket/file?X-Amz-Signature=...
Direct S3 Upload
Your browser uploads the file directly to S3 storage. The file is never stored on our application server during transfer.
File never cached on application server
Confirmation & Storage
After successful upload, the file entry is created in the database and you are notified.
Encryption at Rest
All files are stored with server-side AES-256 encryption. Link passwords are hashed with bcrypt. Sensitive metadata is additionally protected.
Password Hashing
All user and link passwords are hashed with bcrypt. Even in case of a data leak, passwords are protected.
JWT Authentication
Secure, signed tokens for session management. No passwords in the token, only encrypted user IDs.
Server Location
All data is stored exclusively within the EU at Hetzner.
Data Deletion
Data is automatically deleted after expiration. You can remove files manually at any time.
Database Security
PostgreSQL with strict tenant separation. Each organization has isolated data.
Frequently Asked Questions about Encryption
Can you read my files?
Technically, we have access to the files since encryption is server-side. For particularly sensitive data, we recommend our Flaschenpost feature with true end-to-end encryption, where only the recipient can decrypt.
How secure are link passwords?
Link passwords are hashed with bcrypt (10 rounds). Even if someone gained access to our database, they could not see the passwords in plain text. Comparison is done cryptographically secure.
What happens during a server outage?
Your files are redundantly stored on Hetzner Object Storage. Encryption keys are securely managed. In case of an outage, your data remains available once systems are restored.
What encryption does Flaschenpost use?
Flaschenpost uses AES-256-GCM with a key derived via PBKDF2 from the password (100,000 iterations, SHA-256). The encryption key is transmitted in the URL fragment and never sent to our servers.
Security Notes
- All HTTPS connections use TLS 1.3 with modern cipher suites
- Passwords are never stored in plain text - always bcrypt with 10 rounds
- Pre-signed URLs are valid for only 5 minutes and cryptographically signed
- Server location EU: Hetzner Cloud (ISO 27001 certified)
- End-to-end encryption for Connect Messenger (X25519 + XSalsa20-Poly1305) and Flaschenpost (AES-256-GCM + 100,000 PBKDF2 iterations)