Encrypted at rest and in transit.
Revocable at any time.
This page explains exactly how FileLink protects your files: what we encrypt and how, where your data lives, who can reach it, and what we deliberately don't do. It's written for the IT and security teams who review us, so it says plainly where the limits are.
At a glance
Our three rules
No AI
No AI model, LLM or machine-learning system ever reads, summarises, indexes or trains on your files. Not ours, not anyone else's. The AI Insights feature analyses access activity only (who opened what, and when) and never touches file contents.
No Third Party
Your files are never passed to third-party apps, plugins, analytics tools or AI services. They are stored and served only by FileLink's own encrypted storage, which runs on the infrastructure providers listed under Sub-processors.
No Trace
By default, files stream into a secure viewer and are not saved to the recipient's device. When you revoke a link, the recipient has nothing of yours left to open. If you choose to allow downloads for a link, a downloaded copy is outside FileLink's control, so the choice is yours, per link.
Encryption
At rest. Every file is encrypted with AES-256-GCM before it's stored, using a unique key for that file. GCM is an authenticated mode, so any tampering with stored data is detected when it's decrypted.
In transit. Every connection to FileLink (the dashboard, the recipient viewer, the Outlook add-in and the API) uses TLS.
Key handling. Each file has its own encryption key, generated by FileLink's servers. Keys are stored separately from the encrypted files, with access restricted to the service that serves authorised viewers. A file is decrypted only to stream it to a recipient who has passed every rule on the link.
What this means. Because FileLink holds the keys, this is server-side encryption, not end-to-end encryption. We use this design deliberately: it is what lets FileLink stream files to a browser, apply watermarks per viewer, and revoke access instantly. We don't describe it as end-to-end or zero-knowledge, because it isn't.
Where your data lives
- Region: India, Mumbai (AWS ap-south-1).
- Platform: FileLink runs on Supabase, hosted on Amazon Web Services.
- Infrastructure certifications: AWS data centres are certified to ISO 27001 and SOC 2, among others. These certify the infrastructure; FileLink does not claim its own certification.
- Data residency: files, encryption keys and activity logs are all stored in the Mumbai region. If you have specific data-residency or sector requirements, talk to us about your situation.
Access controls
For recipients:
- One-time passcode (OTP): a code sent to the recipient's email, proving they control that inbox
- NDA gate: acceptance of your terms, logged, before viewing
- Expiry: links close at the time you set
- Link access control: allow or block named people and email domains
- Instant revocation: checked on every request, so a revoked link stops working mid-session
For your team:
- Sign-in: each user signs in with their own FileLink account
- Outlook add-in sign-in: a standard OAuth 2.0 (PKCE) flow in a separate secure sign-in window; the add-in never sees your password, and signing out revokes its access
- Outlook add-in permissions: acts only on the email being composed, only when used
The recipient's side
- Files open in FileLink's secure in-browser viewer. No app or account is needed.
- With downloads and printing off (the default), the file is streamed for viewing rather than handed over as a copy.
- Dynamic watermarks put the viewer's email and IP on every page.
- Every page request is checked against the link's rules, so revocation and expiry apply immediately.
Audit trail
For every link, FileLink records:
- every open and page view, with timestamp
- IP address and device
- time spent on each page
- downloads, where allowed
- NDA acceptances
- failed passcode attempts and attempts on revoked or expired links
You can get a real-time email alert when a link is opened.
AI and third parties
FileLink doesn't send your files to any AI provider, and doesn't run AI on them. We don't load third-party analytics or advertising scripts on the recipient viewer. We don't sell or share your data. The only outside parties involved in delivering the service are the sub-processors below.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Infrastructure and storage (via Supabase) | India (Mumbai) |
| Supabase | Database, storage and application platform | India (Mumbai region) |
| Resend | Sending one-time passcodes and email alerts (email address and message only, never files) | United States |
| Vercel | Hosting the website and the Outlook add-in interface (no customer files) | Global edge network |
Data retention and deletion
When you delete a file, the stored file and its encryption key are deleted immediately, and every link to it stops working. Revoking a link ends access but keeps the activity log, so you keep your record.
Limits we want you to know about
We'd rather tell you than have you discover them:
- Screenshots. No web-based tool can stop a screenshot or a photo of a screen. Watermarks make them traceable.
- Allowed downloads. If you allow downloads, that copy can't be recalled. Downloaded files carry the watermark.
- OTP proves inbox access. It confirms the person controls the email address you sent to, not who is physically reading.
- Not end-to-end. FileLink holds the encryption keys, as explained above.
Reporting a security issue
If you believe you've found a vulnerability, email hello@filelink.in with "Security" in the subject line. Please don't access other users' data or disrupt the service. We'll acknowledge your report and keep you updated.
Frequently asked questions
Is FileLink end-to-end encrypted?+
Where is my data stored?+
Is FileLink ISO 27001 or SOC 2 certified?+
Does any AI read my files?+
Can FileLink staff see my files?+
What happens when I revoke a link?+
Can a recipient download the file?+
What does the audit log record?+
Who are your sub-processors?+
Who operates FileLink?+
Need this for a security review?
We'll answer your questionnaire and walk your team through the architecture.