Security you can follow
No buzzwords, just concrete measures. We tell you what is in place today, what will be added for launch – and where the limits are.
Three principles
- When in doubt: noIf a setting is missing or something is unclear, SafeDoc denies access instead of allowing it.
- The server decidesPermissions are checked on the server for every access. A hidden button is not protection for us.
- Secrets only as hashesPasswords, sessions, share and invitation links are stored in the database only as hashes.
How we protect your account
So that only you get in.
Passwords only as hashes
We never store your password in plain text, only an Argon2id hash. At least 10 characters are required.Limits against guessing
After 10 wrong passwords for an account from the same network or 50 attempts per network address within 15 minutes, sign-in pauses. After 5 wrong codes in the second step, it is locked for one hour.Sessions at a glance
Every sign-in is a session with a random key; only a hash is stored. You see all devices and can sign out everywhere else.Safe password reset
The link for a new password is valid for one hour and only once. Afterwards all sessions are ended.No account probing
"Forgot password" always answers the same – the page does not reveal whether an account exists.Two-factor and passkeys
A second step when signing in, which organisations can make mandatory.
How we protect your files
From upload to permanent deletion.
Storage in Germany
Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now.Private storage
There are no public buckets. A file's storage address is random and reveals nothing about its name or content.Every access is checked
The server checks permissions on every access. Other people's files are not "forbidden" to you, they simply "do not exist".Risky files only as downloads
HTML, SVG and XML files are never opened in the browser but downloaded. That way a file cannot run code in your account.Versions and trash
Overwritten or deleted? 30-day trash, older versions 30 days on Plus, 90 days on Pro, Familie, Business and Business Pro – also a safeguard against ransomware on your computer.- Coming soon
Backups
Regular backups kept separate from live operations, with regular restore tests.
How we protect shared links
Sharing should be easy – but not careless.
Unguessable addresses
Every link is a long random address. The database only stores a hash of it.Password, expiry, limit
Password, expiry date and maximum number of downloads are checked on the server – not in your browser.Downloads only for minutes
Anyone downloading via a link gets an address that expires after five minutes.Invisible to search engines
Share pages are blocked for search engines and do not pass on a referrer.Only after email confirmation
Public sharing only works once your email address is confirmed – a safeguard against abuse.In teams only by admins
In an organisation only owners and admins create public links.
All measures at a glance
"Available" means: in the product today. "Coming soon" means: decided, but not built yet.
| Measure | What it means for you | Status |
|---|---|---|
| Encrypted transfer (HTTPS/TLS) | Nobody on the same Wi-Fi can read along. | Available |
| Passwords stored only as Argon2id hashes | Even in a data leak your password is not stored in plain text anywhere. | Available |
| Limits against guessing | Too many attempts at sign-in, sign-up or link passwords are slowed down. | Available |
| Sessions with device list | You see every signed-in device and can sign it out. | Available |
| Permission checks on the server | Every access is checked – not just in the interface. | Available |
| Short-lived download addresses | A copied download address is worthless after minutes. | Available |
| Download limit counted atomically | Even many simultaneous requests cannot exceed your limit. | Available |
| HTML and SVG files only as downloads | An uploaded file cannot run code in your account. | Available |
| Log of important actions | Shares, role changes and deletions remain traceable. | Available |
| Two-factor sign-in with an app | A stolen password alone is no longer enough. | Available |
| Warning on mass changes | If a very large number of files change quickly, we warn you. | Available |
| Private vault (end-to-end) | Only you can read the files inside. | Beta |
The private vault
BetaFor files nobody else should see, there is the private vault. Files and file names are encrypted on your device before they are uploaded. Only you know the key – we only store encrypted data.
How it works
- A key is derived from your vault password on your device (Argon2id). The password never leaves your device.
- Every file gets its own key and is encrypted in parts with AES-256-GCM – large files too.
- When setting it up you receive a recovery key to print or save.
What this means
- There is no back door and no support access. If you lose both your vault password and your recovery key, the files are lost.
- In the vault there is no server-side preview – it would need the server to see the content.
- We still see the size and number of files and timestamps – otherwise we could not provide and bill the storage.
- An honest limit: as with any encryption in the browser, you have to trust that we deliver unmodified program code. We reduce this risk with strict security rules for the page, but we cannot eliminate it.
Beta: not yet externally reviewed
Who at SafeDoc can access data
This is how we are building the administration area: it has no function for viewing file contents. If access is needed in an exceptional case – for example an order from an authority – it requires a justification and confirmation by a second person. Every such access is logged, and we inform you as far as the law allows.
Where your data is stored
| Component | Where |
|---|---|
| Your files and older versions | Data centre in Germany |
| Database (folders, shares, account) | Data centre in Germany |
| Backups | Planned: Germany, separate from live operations (being set up) |
| Payment processing | External payment providers – see privacy policy |
| Email delivery | External delivery service – see privacy policy |
Which providers these are exactly is set out in our privacy policy. Our guide cloud storage in Germany explains more about storage location.
What you can do yourself
- Use a long, unique password you do not use anywhere else – ideally from a password manager.
- Check Settings → Signed-in devices from time to time. A device you do not recognise? Sign out everywhere else and set a new password via "Forgot password".
- Share sensitive files with an expiry date and, where it fits, a password. Send the password via a different channel than the link.
- Tidy up Shared by me regularly and delete links nobody needs any more.
- Do not click sign-in links in unexpected emails. We never ask for your password.
Found a vulnerability?
Thank you for taking a look. Tell us how to reproduce the issue. We will confirm receipt and get back to you with the outcome.
- Do not access other people's data and do not delete anything.
- No load or flooding tests against the service.
- Give us time to fix it before you publish.
Your files stay yours
We never delete silently. These rules are built into SafeDoc:
- Full does not mean goneIf your storage is over its limit – for example after switching to a smaller plan – all files stay. Viewing, downloading, sharing links and the data export keep working; only new uploads pause.
- Missed payment? No deleting.If a payment fails, only new uploads pause after 7 days. Your files stay, and you can still download them and request a data export.
- Your data even if we block an accountIf we block an account, you see the reason after signing in and can download a data package with all files for at least 90 days. Exception: blocks for abuse such as spreading malware – then our support helps.
- No deletion for inactivityWe do not delete accounts that have not been used for a long time – free accounts included.
- Deleting has a safety netWhat you delete stays in the trash for 30 days. You can undo deleting your account for 30 days.
Frequently asked questions
Can SafeDoc read my files?
Regular files are encrypted in transit and kept in private storage. Technically they are accessible to operations, but access is strictly limited. For files nobody but you should be able to read, there is the private vault with encryption on your device – in beta, the encryption has not yet been externally reviewed.
Are my files analysed for advertising?
No. SafeDoc is funded by subscriptions. We neither analyse your files for advertising nor pass them on for that purpose.
Are my files used for AI?
No. We do not use the contents of your files to train AI models and do not pass them on to providers of AI services. Search and previews run without third-party AI services. We would only change this with at least 30 days’ notice and only with your explicit consent.
Is there a data processing agreement for self-employed people too?
Yes, on every paid plan from Plus – including individual accounts, with one click under Settings → Contracts. Professionals bound by secrecy can also conclude a confidentiality agreement under Section 203 StGB there. Both texts are drafts for guidance, not legal advice.
What happens if I forget my vault password?
Use your recovery key to set a new password. If you lose both, the files in the vault can no longer be opened. There is deliberately no back door.
How long is a download link valid?
The address a file is actually downloaded from expires after a few minutes – for share links after five minutes. You decide about the share link itself: no expiry, or after 1, 7 or 30 days.
What should I do if I lose my phone?
Sign in on another device, open the settings and choose "Sign out everywhere else". Then set a new password via "Forgot password" – that also ends all sessions.
Does SafeDoc ever ask for my password?
No. We never ask for your password by email, phone or chat. Anyone who does is not us.
How do I report a security vulnerability?
Write to support@safedoc.de with a description of how to reproduce it. We will confirm receipt and get back to you with the outcome. Please do not access other people's data while testing.
SafeDoc Passwords
Beta (invite only)A password manager in the same account as your files – end-to-end encrypted, with a free basic tier.
See the password managerFree password generator
We open the beta step by step. After signing up, you request access with one click.