Understanding FileSeal's Encryption

Learn how FileSeal's client-side encryption protects sensitive documents with enterprise-grade encryption throughout the entire workflow.

The Personal Safe Analogy

Think of FileSeal like a secure postal service for personal safes:

Imagine you need to send sensitive documents to your office. Instead of posting them in a regular envelope (like email), you:

Lock them in your personal safe (encryption on your device)
Post the sealed safe through a secure courier (FileSeal)
Unlock it at the other end with the key

Nobody who intercepts the safe in transit can open it. Who holds a copy of the key is the choice you make when you create the seal: in the default Email them mode the courier holds one, so it can hand your client a link that just works; in Get a link the key travels inside the link and the courier never has it.

What Makes FileSeal Different

Unlike traditional file sharing services, FileSeal implements client-side encryption:

Documents are encrypted on the client's device (your safe is locked before it leaves your premises)
What travels and what is stored is ciphertext, never the readable file
Who holds the key depends on the mode you choose: in the default Email them mode FileSeal holds it so it can email a working link and build a ZIP; in Get a link the key stays in the link and never reaches FileSeal

Encryption Architecture

Client-Side Encryption Process

File Selection: Client chooses documents to upload
Local Encryption: Files encrypted using AES-GCM-256 before transmission
Secure Transmission: Only encrypted data travels over the internet
Server Storage: Encrypted blobs stored securely
Authorized Decryption: Only you can decrypt using secure keys

Technical Implementation

Why This Matters: This is like having the world's most sophisticated safe lock - even if criminals had every computer on Earth, it would take longer than the age of the universe to break.

Encryption Standard: AES-GCM-256 (Advanced Encryption Standard)

Key Length: 256-bit keys (2^256 possible combinations) (Think of a lock with 78 digits - that's more combinations than atoms in the universe)
Mode: Galois/Counter Mode for authenticated encryption (Not only locks the safe, but proves no one tampered with it)
Security: Same standard used by governments and enterprises (If it's good enough for state secrets, it's good enough for your documents)

Key Derivation: PBKDF2 (Password-Based Key Derivation Function 2)

Iterations: 100,000+ rounds for key stretching (Like creating your key by putting metal through a forge 100,000 times - makes it incredibly hard)
Salt: Unique random salt per encryption (Every safe gets a unique, unpredictable lock mechanism)
Resistance: Protection against rainbow table attacks (Prevents criminals from using pre-made key lists)

Client-Side Architecture

What "Client-Side" Means

Traditional cloud storage requires trusting the provider with your data. FileSeal's client-side encryption means:

Encrypted at the edge: Files are encrypted in the browser, before upload
Your choice of key holder: Get a link keeps the key in the link, out of FileSeal's hands; Email them leaves it with FileSeal so a working link can be emailed
Per-Seal Keys: Each seal uses its own encryption key
Ciphertext at rest: What FileSeal stores is never the readable file

Data Flow Protection

Data flows securely through the following process: Client Device → Encrypt → Secure Transmission → Encrypted Storage Professional Device ← Decrypt ← Secure Download ← Authorized Access

In the Most private option, unencrypted data never exists outside the client's and professional's devices; in the default Email them option FileSeal holds the key so it can prepare your download.

Encryption in Practice

Upload Process Security

When clients upload documents:

File Validation: Type and size checks on client device
File Validation: Type and size checks before encryption
Encryption: AES-GCM-256 applied locally
Integrity Checking: AES-GCM authentication tags verify data integrity on decryption
Secure Upload: Encrypted upload over HTTPS (TLS)

Download Process Security

When you download documents:

Authentication: Verified professional identity required
Authorized Access: Time-limited, one-time download tokens
Secure Retrieval: Encrypted data downloaded over HTTPS
Decryption: In Most private mode files are decrypted on your device only; in the default Email them mode FileSeal decrypts them to build your download
Automatic Cleanup: Encrypted data deleted from servers

Advanced Security Features

File Type Validation

Every uploaded file is checked against an allow-list before it is encrypted:

Type Allow-list: Only PDF, JPG, PNG, DOC, and DOCX are accepted on client upload links
Size Limit: 10MB per file

How Encryption Limits Malicious-File Risk

FileSeal does not run antivirus scanning. Instead, files are encrypted in your browser before they reach our servers, so FileSeal never handles or executes file contents. Combined with one-time download and automatic deletion, this keeps the exposure window small. Recipients should still open documents with their own up-to-date security software.

Audit Trail Encryption

Security logs are also encrypted:

Action Logging: All access attempts recorded
Tamper Evidence: Cryptographic integrity protection
Retention Policy: Secure log storage and cleanup

Compliance & Standards

Regulatory Compliance

FileSeal's security model supports your compliance with:

GDPR: Data protection by design and by default
SOC 2 Type II: Hosted on SOC 2 Type II-certified infrastructure (Vercel, Neon)
Legal Professional Standards: Designed for practices regulated by the SRA and FCA

Industry Standards

Our implementation follows:

NIST Cryptographic Standards: Approved algorithms and key lengths
OWASP Security Guidelines: Web application security best practices
Common Criteria: International security evaluation standards

Encryption Key Management

Key Generation

Cryptographically Secure Random: Keys generated using OS entropy
Unique Per Session: New keys for each upload/download
No Key Reuse: Each document has unique encryption keys

Key Distribution

Secure Channel: Keys transmitted over authenticated TLS
Time-Limited: Keys expire automatically after use
No Persistence: Keys never stored long-term

Key Destruction

Automatic Cleanup: Keys destroyed after successful decryption
Secure Deletion: Memory cleared using cryptographic erasure
Audit Trail: Key lifecycle events logged securely

Frequently Asked Questions

Can FileSeal decrypt my documents?

It depends on the mode you chose, and it is worth knowing which.

Using our safe analogy: FileSeal is a courier carrying a locked safe. In Get a link ("Most private") the key travels inside the link you copy, so the courier never holds it and cannot open the safe. In Email them, which is the default, FileSeal keeps the key so it can email your client a link that just works and assemble a ZIP of several files; there the courier does hold a key.

In technical terms: files are encrypted with AES-GCM-256 in the browser before upload, so what crosses the network and sits in storage is ciphertext either way. What changes between the modes is where the key lives, not whether the file is encrypted.

What if I lose access to my account?

Think of it like having spare keys to your house:

Document encryption keys are tied to your professional identity, not just your password. If you lose access, we have secure ways to verify who you are and restore access to your "safe keys":

Multi-factor authentication options (like having multiple forms of ID)
Professional identity verification (proving you are who you say you are)
Secure key recovery processes (getting new keys made by the locksmith)

How does this compare to email attachments?

Email is like sending documents in a see-through envelope:

Email attachments are typically:

❌ Transmitted unencrypted (like postcards - anyone handling them can read them)
❌ Stored unencrypted on email servers (sitting in filing cabinets anyone can open)
❌ Accessible to email providers (Google, Microsoft can read your files)
❌ Vulnerable to server breaches (one hack exposes everything)

FileSeal is like registered post with a personal safe:

FileSeal documents are:

✅ Encrypted before transmission (safe is locked before leaving your premises)
✅ Stored as ciphertext, never as the readable file
✅ Out of FileSeal's reach entirely if you choose Get a link (the key rides in the link)
✅ Deleted from FileSeal's servers after download or expiry

Best Practices for Professionals

Secure Handling

Download Promptly: Minimize exposure time
Secure Storage: Use encrypted local storage
Access Control: Limit who can access downloaded files
Secure Disposal: Delete files securely when no longer needed

Client Education

Help clients understand using simple analogies:

Why encryption matters: "Your documents are like valuable jewelry - you wouldn't post them in a regular envelope, would you?"
How FileSeal protects privacy: "Your documents are locked before they leave your device, so nobody can read them in transit, and they are cleared from FileSeal's servers once I have collected them"
Security advantages over email: "Email is like sending a postcard - anyone handling it can read it. FileSeal is like sealed, tamper-proof packaging"
Their rights under data protection laws: "You can ask me what I hold, ask for a copy, and ask me to delete it. FileSeal clears its own copy automatically after I download it or when the link expires"

Real-world example to share: "Instead of emailing your passport copy (which could be read by hackers, email providers, or anyone with access to email servers), FileSeal encrypts it before it leaves your device. Even if someone intercepts it, they just have a locked safe with no key."

Want to learn more? Explore our Security Features Guide or review GDPR Compliance requirements.

Understanding Encryption