Trust

Security

Last reviewed: 1 September 2026

VP Sendit combines browser-side encryption with account, session and infrastructure controls. This page describes the protection offered and its important limits.

File encryption

• Each file is encrypted in the browser with a unique AES-256-GCM key before upload.
• Protected metadata, including the filename and MIME type, is encrypted separately.
• The private Cloudflare R2 bucket stores ciphertext rather than readable file contents.
• Encrypted inbox transfers wrap a file key for the selected recipient through ECDH P-256 key agreement.
• AES-GCM integrity checks cause modified ciphertext to fail decryption.

Accounts and sessions

• Passwords are processed through PBKDF2-HMAC-SHA256 with 600,000 iterations; readable passwords are not stored. Before database storage, the browser proof is protected again with an independent server-side HMAC pepper so a copied database verifier cannot be replayed as a login proof.
• Optional TOTP MFA works with standard authenticator apps.
• Sessions use signed, secure, HttpOnly, SameSite cookies and expire within 12 hours.
• Every session has a revocable server record. Account settings can sign out one or all other devices immediately.
• State-changing requests require same-origin and CSRF checks.
• Registration, invite requests and password recovery require server-verified Cloudflare Turnstile tokens and have separate rate limits. MFA attempts are limited per network client and per temporary challenge.
• QR sign-in requests are short-lived, one-time and require approval from an authenticated device.

What remains visible

End-to-end encryption protects file contents, not every piece of metadata. The service can still process account identifiers, recovery email, sender and recipient relationships, timestamps, object sizes, session details and network information needed by Cloudflare. Resend processes the recipient address and content of requested account email.

Your security responsibilities

• Use a unique password and enable MFA.
• Keep the recovery key offline and private.
• Review signed-in devices and revoke anything unfamiliar.
• Use Forget this browser and log out on shared devices.
• Do not approve a QR sign-in unless its device and verification code match.

Security limits

No service is perfectly secure. Encryption cannot protect a file after you open it on a compromised or unlocked device. A person with control of the live web application could attempt to alter browser code, so Cloudflare account security, controlled deployments and browser protections remain important. VP Sendit is temporary storage and should not be your only copy of important data.

Responsible disclosure

If you believe you found a vulnerability, stop before accessing another person’s account or data. Do not perform denial-of-service testing, social engineering or destructive actions. Record the affected URL, steps and impact, then privately contact the administrator who provided your invitation. Please allow reasonable time for investigation before sharing details publicly.