# Security & privacy

Source: https://help.strongfolder.com/en/security/
Updated: 2026-11-05

> With StrongFolder your files travel from your browser to the recipient's browser over a WebRTC connection that is always encrypted with DTLS. They are never stored on a StrongFolder server. If a direct connection is impossible, the encrypted stream passes through our relay without being saved. We keep only transfer metadata, such as file names and sizes.

## Where do my files go?

From your device straight to the recipient's device. StrongFolder does not upload your files
to a cloud and does not keep a copy. The service's servers help the two browsers find each
other and, when needed, relay the encrypted stream — they do not store file contents.

**Key facts**

- **In transit:** WebRTC encrypts every data channel with DTLS, so the file stream is encrypted in transit on every connection.
- **At rest:** Files are never uploaded to or stored on a StrongFolder server.
- **Relay:** If a direct connection is impossible (strict corporate firewall, some mobile networks), the encrypted stream passes through a StrongFolder relay (TURN) server. The relay forwards the data and does not store it.
- **Metadata:** To create the link, the service keeps transfer metadata: file and folder names, sizes and the number of files.
- **Access:** anyone with the link while you are sharing; Stop Sharing ends it.

## How is a transfer protected?

| Stage | What happens | Protection |
|---|---|---|
| Creating the link | Your browser registers the session: names, sizes, file count | HTTPS to strongfolder.com |
| Connecting | A signalling service introduces the two browsers | HTTPS / secure WebSocket |
| Transfer (direct) | Data flows browser to browser | WebRTC data channel, DTLS encryption |
| Transfer (relayed) | A StrongFolder TURN server forwards the stream | The stream stays DTLS-encrypted between the two browsers; the relay forwards it and does not store it |
| After the transfer | You stop sharing or close the tab | The link no longer serves files |

## What does "not stored" mean exactly?

The content of your files never sits on a StrongFolder server — not for a minute, not for
seven days. Compare that with transfer services that keep an uploaded copy for days or weeks.
What we do keep is the information needed to show the link page: file and folder names, sizes
and the number of files. If you choose to sign in with Google, your e-mail is kept so you can
see your transfers.

## Is a peer-to-peer transfer safe?

"Peer-to-peer" here means **your browser talks to one recipient's browser** — it is not a public
file-sharing network like BitTorrent, and your files are not offered to strangers. The
recipient needs your link. The risks to manage are the usual ones for any link:

1. **Share the link privately** — in a direct chat or e-mail, not in a public post.
2. **Check who is downloading** — StrongFolder shows how many users are connected.
3. **Stop sharing** when the recipient has the files.
4. **Keep your browser updated** — WebRTC security comes from the browser.

## Does my IP address become visible?

For a direct connection, the two browsers exchange network addresses, as in any video call.
If you don't want the recipient to see your IP address, use a VPN; the transfer will then run
through the VPN or our relay.

## Read more

- [Secure file sharing: a practical guide](https://help.strongfolder.com/en/guides/secure-file-sharing/)
- [How WebRTC file transfer works](https://help.strongfolder.com/en/guides/how-webrtc-file-transfer-works/)
- [Privacy Policy](https://help.strongfolder.com/en/privacy-policy/) · [Cookie Policy](https://help.strongfolder.com/en/cookie-policy/)

[Send files now](https://strongfolder.com)

## FAQ

### Is the transfer encrypted?

WebRTC encrypts every data channel with DTLS, so the file stream is encrypted in transit on every connection.

### Can StrongFolder see my files?

Files are not uploaded or stored, so there is nothing on our servers to look at. When a transfer is relayed, the relay forwards the encrypted stream and does not save it.

### What data do you keep?

To create the link, the service keeps transfer metadata: file and folder names, sizes and the number of files. If you sign in with Google, we also keep your e-mail address to show your transfers. See the [Privacy Policy](/privacy-policy/).

### Who can download my files?

Anyone who has the link, while you are sharing. Send it only to the people you mean, and click Stop Sharing when they are done.

### Can I protect the link with a password?

Not at the moment. Treat the link like a key: share it privately and stop sharing after the download.

### Is StrongFolder suitable for confidential documents?

It avoids the biggest risk of transfer services — a copy left on someone else's server. For regulated data, check your organisation's rules; some require approved tools or encryption with your own keys.