Documentation

Secure File Transfer documentation

How each part of Secure File Transfer behaves, why it was designed that way, and what it takes to run it. Every page is drawn from the project's requirements, architecture and security design, which are public on GitHub.

Getting started

IntroductionWhat the service is, who it's for, what v1 does and what it deliberately doesn't.
Core conceptsTenants, members, transfers, upload requests, links, verification and file states.

Using it

Sending filesShare files up to 5 GB each with people outside the company, by expiring link.
Requesting filesSend an upload link so someone outside can deliver files to you.
Recipient verificationOne-time codes, verified sessions, lockouts and why a forwarded link gets nothing.
Revocation and retentionCutting off access in seconds, link expiry, and when every copy of a file is deleted.

Protection

Malware scanningTwo scanners, and nothing downloadable until a file is clean.
Data loss preventionDetectors for personal data and secrets, and rules that warn, hold or block.
Audit logWhat is recorded, how admins search and export it, and why it can't be changed.
Administration and sign-inRoles, MFA, single sign-on, tenant policies and API keys.

Engineering

ArchitectureOne API service plus workers, one system of record, and the AWS services around them.
Security modelThreat model, encryption and keys, authorization, isolation and abuse limits.
Reliability and recoveryAvailability, latency, RPO and RTO targets, regional failover and data residency.
APIA contract-first REST API, its conventions and how CI keeps code and contract together.
Deployment and operationsAccounts per environment, Terraform, GitOps on EKS, promotion and rollback.

Get it

Licensing and engagementWhat the licence allows, and the two ways to get it for your business.