Advanced Security Features

Explore FileSeal's security architecture including file validation, audit trails, and account-level monitoring.

What This Means for Your Practice

What actually protects your documents:

• File Validation: Every upload is checked against the accepted document types and a size limit
• Audit Trails: Uploads, downloads and collections are recorded against the request. There is no screen for browsing them; you get the activity report from Settings, and we can pull the underlying rows if a regulator asks
• Activity Notifications: You are emailed when a client uploads, within about ten minutes
• Per-member permissions: On a Teams plan, who can create seals and who can see everyone's

Bottom line: the encryption, validation, logging and notifications above are on by default for every request, on every plan, including the free trial. Per-member permissions need a Teams plan.

Multi-Layer Security Architecture

Layer 1: Client-Side Protection

File Validation Before Encryption

What this protects you from:

• A client accidentally uploading the wrong file type
• A renamed executable disguised as a document

How it works:

• Type Allow-list: Only PDF, JPG, PNG, DOC, and DOCX are accepted
• Size Limits: Oversized uploads are rejected before processing

There is no magic-byte inspection on document uploads: the type check reads what the browser declares, not the file's header, so treat it as a filter rather than proof of what a file contains. The only upload that is checked byte-by-byte is your company logo.

FileSeal does not run antivirus scanning. Files are encrypted in your browser before they reach our servers, and we never execute them; one-time download and automatic deletion keep the exposure window small. Recipients should still open documents with their own up-to-date security software.

File Validation Systems

• Content Type Allow-list: Only the accepted document types are permitted
• Size Limit Enforcement: Prevents oversized uploads

Layer 2: Transmission Security

Encryption During Transit

• TLS: Transport security on every connection
• Per-Seal Keys: Each seal uses its own key
• No intermediate decryption: Files are already encrypted client-side, so nothing in transit can read them

Network Security

• DDoS Protection: Automatic attack mitigation (Vercel platform)
• Rate Limiting: Per-IP and per-action throttling to deter abuse

Layer 3: Server-Side Security

Ciphertext-Only Storage

• No Plaintext Storage: The server only ever holds ciphertext
• Encrypted at Rest: Stored blobs are encrypted
• Key handling: In zero-knowledge mode the encryption key never reaches the server (it stays in the link fragment); in email mode it is stored separately from the ciphertext

Infrastructure

• SOC 2-certified hosting: Runs on Vercel and Neon, both SOC 2 Type II certified
• Managed platform updates: Security patches applied at the hosting-platform level

How FileSeal Handles Malicious Files

FileSeal does not run antivirus or malware scanning, and its protection model is deliberately different:

• Encryption-first: Files are encrypted in your browser before upload, so what reaches FileSeal is ciphertext. In Get a link mode the key stays in the link and never reaches FileSeal at all; in the default Email them mode FileSeal holds the key so it can build a ZIP. Either way the uploaded bytes are never executed.
• Validation, not scanning: Uploads are checked by declared type and by size. There is no magic-byte inspection on document uploads, so treat the type check as a filter rather than proof of what a file contains.
• Minimal exposure: One-time download and automatic deletion mean a file exists on our servers only briefly.

Because file contents are never inspected, recipients should always open downloaded documents with their own up-to-date antivirus and treat macros or embedded scripts with normal caution.

Audit Trails - What Is Recorded

Why This Matters

Like having a security camera system for your documents - you can prove exactly what happened and when, protecting you from disputes and demonstrating compliance to regulators.

What Gets Recorded

Note what is not here: creating a seal writes no audit row of its own. The first entry is usually the delivery receipt for the client's invitation email, then the upload.

Professional Activities:

• Email delivery confirmations to clients (proof the invitation was sent)
• Client upload attempts and successes (recording who entered the building and when)
• Your download activities (when you accessed the documents)
• Automatic cleanup and deletion (when the security footage was archived)

That is the whole list. There is no anomaly detection, and a rejected upload writes no row: validation fails and the request returns before anything is logged.

What the record looks like

15 Jan 2025, 2:31 PM: Secure email sent to sarah.client@email.com
15 Jan 2025, 4:45 PM: Client uploaded 3 documents (validated and encrypted) 16 Jan 2025, 9:15 AM: You downloaded documents (1 ZIP file)
16 Jan 2025, 1:00 PM: Documents cleared from FileSeal's servers by the scheduled clean-up

Technical details (for compliance): Request ID: req_abc123 | IP address | Browser: Chrome 120.0.0.0

Retention Policies

• Active Requests: Uploads, downloads and collections logged as they happen
• Completed Requests: The log outlives the documents, which are cleared from FileSeal's servers
• Professional Records: Exportable as an activity report from Settings

Notifications

FileSeal is deliberately modest here: there is no monitoring dashboard, no threat detection and no SMS or push channel. What exists is email, and you control it per category in Settings.

What FileSeal emails you

• Documents uploaded: sent when your client finishes uploading to a request
• Documents collected: sent when a recipient downloads something you sent
• Expiry notices: sent after a request has expired without being collected

The first is governed by "Email me when clients upload files", which also gates the request-expiry notice and the trial reminder emails. The second, and the expiry notice for something you SENT, are governed by "Email me when documents are downloaded or collected". Turning one off does not turn off the other, and each covers more than its label suggests, which is why both are listed here.

What is recorded

Uploads, downloads and collections are written to the audit log against their request. Creating a seal is not. Any signed-in account can download an activity report of its requests with their status, expiry and download count.

Professional Security Controls

Access Control Management

Authentication Security

• Multi-Factor Authentication: Available, and enforceable across a team by its owner
• Session Management: Automatic timeout protections

Authorisation Controls

• Professional-only access to sensitive features
• Client access limited to specific requests
• Time-based access controls

Data Loss Prevention

Upload Restrictions

• File type limitations for security
• Size restrictions prevent abuse
• Content scanning for sensitive data
• Professional approval workflows

Download Protection

• One-time download enforcement
• Time-limited access windows
• Download attempt monitoring
• Unauthorized access prevention

Compliance & Regulatory Support

Professional Standards Compliance

Legal Profession Requirements

• SRA Compliance: Solicitors Regulation Authority
• Law Society Standards: Professional conduct rules
• GDPR Compliance: Data protection regulations
• Client Confidentiality: Professional privilege protection

Financial Services Compliance

• FCA-Regulated Firms: Designed for firms regulated by the Financial Conduct Authority
• Payments: Processed by Stripe (PCI DSS Level 1) — FileSeal never handles card data
• SOC 2 Type II: Hosted on SOC 2 Type II-certified infrastructure (Vercel, Neon)

Regulatory Reporting

Compliance Documentation

• Security incident reports
• Data processing records
• Client consent documentation
• Professional obligation compliance

Audit Support

• Uploads, downloads and collections logged
• Regulatory inquiry assistance
• Professional standard verification
• Compliance statement provision

What the paid plans add

• White-label branding on client-facing pages
• Team accounts with per-member permissions, and 2FA enforceable team-wide
• Unlimited seals, rather than the trial's five

Configurable expiry is NOT one of them: it is on every plan, including the trial.

There is no Enterprise tier, no SSO or Active Directory integration, and no IP allow-listing. If you need any of those, say so and we will tell you honestly whether it is on the roadmap.

---

Next Level: Explore GDPR Compliance or learn about Professional Customization.