How FilePost Keeps Your Files Secure: Infrastructure and Practices

File security is not one feature. It includes transport encryption, storage access, URL behavior, deletion, authentication, and the limits of what the service can guarantee. This article separates those controls from assumptions.

This is a technical breakdown of the controls FilePost can verify today. The shorter Security and Data Handling page is the canonical summary, including current limitations and retention.

HTTPS Everywhere

Every connection to FilePost is encrypted with TLS. There are no exceptions and no fallbacks to plain HTTP.

• API traffic: All requests to filepost.dev/v1/* are served over HTTPS with TLS 1.2 or higher. HTTP requests are redirected to HTTPS automatically.
• CDN delivery: Files served from cdn.filepost.dev use HTTPS. When you share a file URL, recipients access it over an encrypted connection.
• Certificate management: TLS certificates are managed automatically through Cloudflare, eliminating the risk of expired or misconfigured certificates.

This means that when you upload a file, the data in transit is encrypted between your application and FilePost's servers. When someone downloads the file using the CDN URL, that transfer is also encrypted. At no point does file data travel over an unencrypted connection.

Authentication: API Key Model

FilePost uses API key authentication for all operations. Every request must include your API key in the X-API-Key header:

curl -X POST https://upload.filepost.dev/v1/upload \
  -H "X-API-Key: your_api_key_here" \
  -F "file=@document.pdf"

The API key system has three jobs: identify the account, authorize the request, and allow the key to be rotated if it is exposed.

• One key per account. Your API key is generated when you sign up and is tied to your email address. All uploads, file listings, and deletions are scoped to your key.
• Key validation on every request. The API server checks the key against the database before processing any operation. Invalid or missing keys receive a 401 response immediately.
• Keys are generated with a secure random source. Treat the returned key as a credential and do not expose it in client-side code, logs, or public repositories.
• No shared access. Each API key can only access files uploaded with that same key. There is no way for one user to list, view, or delete another user's files through the API.

Best practices for API key management

• Store your API key in environment variables, not in source code.
• Never include your API key in client-side JavaScript for production applications. Use a server-side proxy (see our React and Next.js guide for examples).
• If you suspect your key has been compromised, rotate it with POST /v1/rotate-key. Rotation invalidates the old key.

Storage: Backblaze B2 with a Capped Fallback

FilePost stores all uploaded files on Backblaze B2, an enterprise-grade object storage service. Backblaze was chosen for its combination of reliability, durability, and cost efficiency.

Provider separation

Backblaze B2 is the primary file store. Cloudflare R2 is configured as a tightly capped fallback for new uploads during a narrow class of transient B2 failures. The fallback is a continuity control, not a promise that every uploaded file is duplicated across both providers.

Availability

Files are delivered through Cloudflare's CDN. A known file on the primary delivery path and a separate known file on the fallback provider are checked for exact bytes every five minutes from an independent server. See the live customer-safe result.

Isolation

File objects use random identifiers rather than sequential paths, and directory listing is not exposed. Knowing one file's URL does not reveal other account files. The URL you do know remains public, so this isolation must not be treated as private access control.

CDN: Cloudflare Network and DDoS Protection

Every file uploaded to FilePost is delivered through Cloudflare's global CDN network. This provides two critical benefits: performance and protection.

Performance

• Distributed delivery. Files can be cached closer to the recipient instead of every download reaching storage directly.
• Automatic caching. Cache behavior depends on the file, request, and Cloudflare response; FilePost does not publish a universal latency promise.
• Unlimited bandwidth. All FilePost plans include unlimited bandwidth with no egress fees. Cloudflare's network handles traffic spikes without throttling or surcharges.

DDoS Protection

Cloudflare automatically mitigates DDoS attacks at the network edge. This is not an add-on feature; it is built into every Cloudflare plan. For FilePost, this means:

• Volumetric attacks (flooding with traffic) are absorbed by Cloudflare's network before reaching the origin.
• Cloudflare protects the proxied website and primary CDN surfaces. The dedicated upload host is DNS-only so larger request bodies can reach the application.
• Application rate limits, upload concurrency controls, and early body-size guards provide separate protection at the API layer.

These layers reduce exposure, but no architecture guarantees that legitimate requests will always remain available during an attack or provider incident.

File Access Model: Public URLs with Unguessable Paths

FilePost generates public CDN URLs for uploaded files. This means anyone with the URL can access the file, similar to how an "unlisted" YouTube video works. The security model relies on the unguessability of the URL path.

A file URL has two separate concerns: identifying the stored object and deciding who can fetch it.

https://cdn.filepost.dev/file/filepost/uploads/a1/a1b2c3d4e5f6.pdf

The file path contains a unique, randomly generated identifier. These IDs are long enough that brute-force enumeration is computationally infeasible. There is no sequential numbering, no predictable pattern, and no directory listing.

When this model is appropriate

• Publicly shared files: documents, images, downloads, assets that are meant to be accessed via a link.
• Application assets: user avatars, uploaded media in a CMS, file attachments in a support system.
• Temporary shares: files that will be shared with specific people via a direct link.

When to add your own access control

If your application requires authenticated file access (for example, only logged-in users can download a file), you should implement that access control in your own application layer. One common pattern: store the FilePost URL in your database, and only return it to authenticated users through your own API. The FilePost URL itself remains accessible, but only your app knows what it is.

No File Type Restrictions, Isolated Storage

FilePost accepts any file type: images, PDFs, documents, archives, binaries, configuration files, database exports, and anything else you need to host. There is no whitelist or blacklist of allowed file extensions.

The reason this is safe is storage isolation. Uploaded files are stored as inert objects in Backblaze B2 and served as static downloads through Cloudflare. They are never executed, parsed, or processed on the server. A file with a .exe extension is treated the same as a .txt file: it is stored and served, nothing more.

This is fundamentally different from a traditional web server where uploaded files might be executed (for example, a PHP file in a web root). FilePost's architecture eliminates this entire class of vulnerability because files never enter an execution context.

Data Deletion API

You can permanently delete any file you have uploaded through the API:

curl -X DELETE https://filepost.dev/v1/files/a1b2c3d4e5f6 \
  -H "X-API-Key: your_api_key_here"

When you delete a file:

• The file is removed from Backblaze B2 storage.
• A CDN cache purge is requested. The API does not represent a best-effort provider purge as an absolute guarantee.
• The file record is removed from the FilePost database.
• The deletion is permanent and cannot be undone.

This gives you full control over your data lifecycle. If a user requests deletion of their data, or if you need to remove a file for any reason, a single API call handles it completely.

Listing files before deletion

To see all files associated with your account:

curl https://filepost.dev/v1/files \
  -H "X-API-Key: your_api_key_here"

This returns a JSON array with each file's ID, URL, and size. You can use this to audit your uploaded files or build a bulk deletion script:

import requests

API_KEY = "your_api_key_here"
BASE = "https://filepost.dev/v1"

# List all files
files = requests.get(f"{BASE}/files", headers={"X-API-Key": API_KEY}).json()

# Delete all files (use with caution)
for f in files:
    requests.delete(f"{BASE}/files/{f['file_id']}", headers={"X-API-Key": API_KEY})
    print(f"Deleted: {f['file_id']}")

Payment Security: Stripe Integration

FilePost uses Stripe for all payment processing. This means:

• No credit card data touches FilePost servers. Card numbers, CVVs, and billing details are submitted directly to Stripe through their secure checkout page. FilePost never sees, stores, or processes raw payment information.
• PCI DSS compliance. Stripe is a Level 1 PCI Service Provider, the highest level of certification in the payment card industry. By using Stripe's hosted checkout, FilePost inherits this compliance without handling sensitive card data.
• Subscription management. Plan upgrades, downgrades, and cancellations are handled through Stripe's billing portal. Your billing information is managed entirely within Stripe's secure infrastructure.

The free tier requires no payment information at all. You can sign up with just an email address and start uploading immediately.

Disposable Email Blocking

To prevent abuse of the free tier, FilePost blocks signups from disposable email services (like Mailinator, Guerrilla Mail, and similar throwaway providers). This serves multiple security purposes:

• Prevents abuse. Without this protection, a single person could create unlimited free accounts using throwaway emails, bypassing the 30-upload monthly limit.
• Maintains service quality. Abuse from throwaway accounts can degrade performance for legitimate users. Blocking disposable emails keeps the free tier sustainable.
• Reduces spam uploads. Throwaway accounts are frequently used to upload spam or phishing content. Requiring a real email address adds accountability.

The disposable email check happens at signup time. If you are using a legitimate email provider that is incorrectly flagged, contact support for a manual review.

Infrastructure Summary

The security controls in FilePost's architecture fall into these layers:

Frequently Asked Questions

Can other users access my files?

Not through the API. The list and delete endpoints only return files uploaded with your API key. However, the CDN URLs themselves are public: anyone with the link can download the file. If you need authenticated access, implement that in your application layer.

Are files encrypted at rest?

Uploads and downloads use HTTPS. FilePost does not currently promise application-level encryption, customer-managed keys, or B2 server-side encryption for hosted public files. Nightly database backup archives are encrypted before leaving the application server; that recovery control is separate from hosted files.

What happens if Backblaze goes down?

Some previously requested files may remain cached at Cloudflare. For a narrow class of transient B2 upload failures, FilePost can place new objects in a tightly capped R2 fallback. Neither behavior is presented as a universal outage guarantee.

Can I delete all my data?

Use the list endpoint to get file IDs, then call the delete endpoint for each file. Contact support for account deletion. Active-system removal is targeted within 30 days where reasonably possible; encrypted recovery backups rotate out within 180 days, and some legal or security records may be retained longer.

Is FilePost GDPR compliant?

FilePost is based in Sweden and publishes its providers, retention, and user rights in the Privacy Policy. There is no self-serve DPA or formal compliance certification today. Contact support before using FilePost for a workflow that requires special regulatory controls.

Do you scan uploaded files?

FilePost does not promise malware scanning. Files are generally stored and served as uploaded, while reported content and abuse signals may be reviewed under the Terms. Treat files from untrusted uploaders as untrusted input.

Pricing Tiers

The transport, authentication, monitoring, and public-file boundaries described here apply across plans:

• Free: one provisional upload before verification, 15/month after email verification, 50MB max file size, 2GB storage, unlimited bandwidth
• Lite ($4/mo): 300 uploads/month, 100MB max file size, 10GB storage
• Starter ($9/mo): 1,500 uploads/month, 200MB max file size
• Pro ($29/mo): 7,500 uploads/month, 500MB max file size

There are no separate security tiers. HTTPS, CDN delivery, Backblaze B2 storage, DDoS protection, and the data deletion API are available to every user.