Security & privacy
Private by design, verified at every step
This page explains, in plain language, how R2Cloud handles your data. We describe what the system does, not badges we have not earned.
Architecture
Where your data lives and who can reach it
Private object storage
File contents are stored in a private Cloudflare R2 bucket. There are no public object URLs; the bucket rejects anonymous requests.
Short-lived signed links
Every preview or download uses a URL signed for one object and one operation, valid for minutes, issued only after R2Cloud has authorised the request.
Verified uploads
Your browser uploads directly to storage; R2Cloud then checks the stored object's real size before the file appears and before it counts toward your quota.
Encryption in transit
All traffic between your browser, R2Cloud and the storage provider uses HTTPS. Storage providers encrypt data at rest on their side.
Server-side permissions
Every operation on a file, folder, link or workspace is authorised on the server using the signed-in session, never by what the browser claims.
Audit trail
Uploads, shares, deletions, role changes and administrative actions are logged with actor, time and source IP.
Your account
Account security
Strong credentials
Passwords are hashed with scrypt and must be at least 10 characters. Sign-in attempts are rate limited per account and address.
Sessions you control
Sessions live in HttpOnly cookies, never in local storage. You can see and revoke every session, and password changes sign out other devices.
Password-confirmed changes
Changing your email or deleting your account requires your current password. We do not send email, so keep your password safe; support can set a temporary one if you lose it.
Sharing
Nothing you upload is visible to anyone else until you create a share link. Links use 256-bit random tokens stored as keyed hashes, can be password-protected, can expire, can be limited to a number of downloads and can be revoked instantly. Trashing or deleting a file, leaving a workspace, or suspension of an account automatically disables the links attached to it.
Workspaces
Workspace files belong to the workspace, not to the person who uploaded them. Roles (owner, administrator, editor, viewer) are enforced on the server for every action. A workspace always has exactly one owner, who alone controls billing, ownership transfer and archiving.
Payments
Card details are entered on Stripe-hosted pages and never reach R2Cloud. We store only Stripe identifiers and subscription status. Subscription changes are applied from Stripe webhook events whose signatures we verify; a success page on its own never grants storage.
What we do not claim
R2Cloud has not undergone a third-party security certification such as SOC 2 or ISO 27001, and we do not claim HIPAA or similar compliance. Files are not end-to-end encrypted with keys only you hold: the service can read object contents in order to generate previews and serve downloads. If you need zero-knowledge storage, encrypt files before uploading them.
Reporting a problem
If you believe you have found a security issue, please contact us with details. We respond to every report.
Keep your files where you decide who sees them
Create a free account and share your first file in minutes.