Your files. Your control.
Skypost is built around one idea: a file transfer should be quick, the link should expire, and only the people you choose should ever open it. Here is exactly how that works under the hood, in plain English.
How files are protected
What happens to the bytes themselves, end to end.
Every connection to Skypost uses HTTPS — the same encryption your bank uses (the padlock in your browser bar). Files cannot be intercepted on their way in or out.
Before any file lands on cloud storage, Skypost encrypts it with AES-256-GCM. Each folder gets its own random data-encryption key, wrapped twice — once with a key derived from your folder password, then again with a master key that lives only on Skypost's servers.
Encrypted files live in private cloud storage. There is no public bucket, no listing, no direct URL. When you or a recipient open a file, Skypost streams it through our servers and decrypts it on the fly.
Files are stored under random IDs, not under your filename, so even storage-level metadata gives nothing away.
How access is controlled
Who gets in, and how we stop the people who shouldn't.
Every folder gets a unique three-word password (e.g. anchor-velvet-river). Easy to share verbally, hard to guess, and rotated through a cooldown pool so the same one isn't reused on a new folder for a long time. You can also set your own.
Repeated wrong-password tries on a folder are slowed down and then blocked, so a bot can't brute-force the three-word combination. Every failed attempt is logged.
For very sensitive transfers, switch a folder to 'secure URL' mode. Recipients then need both a long, unguessable link and the folder password to get in. If the link leaks in a forwarded email, the contents stay protected.
Free folders expire after 7 days. Paid plans extend that to 30 or 90 days. Once a folder expires, the link no longer works and the encrypted bytes are scheduled for deletion.
When you archive a folder from your dashboard, the link stops working immediately. If you ever revive it, Skypost re-wraps the encryption key with your new password — old passwords can't unlock revived folders.
How accounts are protected
Login security for the people who do sign in.
We store a one-way bcrypt fingerprint, not the password itself. Strong passwords are required from the start.
Repeated wrong-password attempts on the same account are rate-limited and then blocked.
If we ever need to suspend an account, the next login attempt fails and the user is told to contact support.
Sign-in tokens last 7 days. Folder unlock sessions last 1 hour, then you'll need to re-enter the password to download more files.
How teams stay separate
Your data sits in its own bubble.
Every folder, member, brand setting and audit row belongs to a single team. There is no shared path between teams — you cannot see another team's data, and they cannot see yours.
Inside a team you can assign Owner, Admin or Member. Members upload and download. Admins manage folders and members. Owners also control billing, branding and your custom domain.
What we track, and what we don't
Privacy by design, not just by promise.
When we log activity — folder access, login attempts, share clicks — we hash the visitor's IP first with SHA-256. Raw IPs are never retained.
Folder pages do not load Google Analytics, Facebook pixels or any third-party trackers. The only event we record on a folder is the share-button click, so the folder owner can see how their link travelled.
Folder creation, opens, downloads, password attempts, archives, member changes and more are written to an audit trail with timestamps and a hashed IP, so account holders and team owners have a clear record.
What we do not claim
Skypost is built for convenience: we generate the three-word password and show it on the folder page, so the platform itself stores it. That means files are technically recoverable by Skypost staff with full server access. We never read your files except where required by lawful process or to investigate abuse, and the encryption-at-rest model means a single-system breach (database alone, or storage alone) reveals nothing on its own.
If you need true zero-knowledge — "not even Skypost can read this" — please contact us about Enterprise. We can configure customer-managed keys.