Security & honesty
We describe only what is actually implemented. Here is exactly how Fliqa Sharing protects your files — and where the real limits are.
What we do
- Files are stored in private storage — never a public bucket.
- Downloads and previews use short-lived, signed authorization tied to your session or an authorized share link.
- Every read, write, preview, and download is authorized on the server at the object level.
- Share links use long, unguessable tokens; they can expire, cap downloads, require a password, restrict to emails, or be revoked instantly.
- Sensitive events (login, permission changes, link creation and revocation, admin actions) are written to an audit log.
- Passwords are hashed with bcrypt; sessions use httpOnly cookies with same-origin CSRF checks and rate-limited login.
What we do NOT claim
- Not end-to-end encrypted. Files are encrypted in transit (HTTPS) and can be stored with provider-side encryption, but the server can access file contents to generate previews and ZIPs.
- Preview-only isn't screenshot-proof. We block downloads server-side for preview-only links, but any content your browser can render can be screen-captured. We won't pretend otherwise.
- Malware scanning is not enabled by default. Until a scanning service is integrated, uploaded files are not scanned; we document this rather than imply protection.
Operator Notice: Fliqa Sharing infrastructure and security controls are managed and operated by FLIQAINDIA PRIVATE LIMITED. For security disclosures or vulnerability reports, please reach out to our security and support desk at support@fliqaindia.com.