Security
How ReceiveVault keeps files safe
Last updated October 5, 2026
The technical building blocks behind secure file collection. Security is a shared responsibility - these are the controls we provide.
We never sell your information, directly or through a related company
We do not sell, rent, or trade personal information or uploaded files, and we do not pass them to affiliates, subsidiaries, partners, or data brokers, which is how some companies keep a "we don't sell your data" promise on paper while the data is sold anyway. The only outside parties that handle your data are the service providers named on our sub-processors list, and we disclose it to authorities only when a valid legal demand compels it or someone faces an imminent risk of death or serious bodily harm, and we tell the affected customer unless a court order forbids it. Read the full pledge.
Uploads are virus-scanned
Every file we can read, up to 512 MiB, is streamed through ClamAV before it can be downloaded. A malicious file is deleted immediately, the event is written to your audit log, and you are notified by email. Three kinds of file are not scanned and are marked as such: end-to-end encrypted uploads, whose contents are unreadable to us by design; files above the 512 MiB scanning limit; and files whose scan failed. You must acknowledge the unscanned status before downloading one of those.
Encrypted in transit and at rest
All traffic runs over TLS. Files are stored in S3-compatible object storage with server-side encryption - never copied to third-party clouds.
Optional end-to-end encryption
On Business and Enterprise plans, files can be encrypted in the contact's browser with your account's public key, so their contents are unreadable by anyone but you - including us. We hold no copy of your private key; if you lose it, encrypted files cannot be recovered by anyone, including us.
Full audit log
Every meaningful action - request created, link sent, file uploaded, file downloaded - is timestamped with the actor, giving you a defensible record of who did what, when. Audit entries are kept for 12 months. Export them at any time for a longer record.
No account for your clients
Contacts upload through a magic link addressed to them, with optional one-time-code email verification you can require. There is no password for them to reuse or leak, and no extra account to manage.
Expiry and retention controls
Every link expires, and every file has a deadline. A request link carries an expiry you choose when you create it (30 days by default, 90 at most), and outbound deliveries carry one you set per send along with an optional download limit. Once a link expires it stops working. Received files are then permanently deleted 90 days after the request's last activity by default, or on the window you choose, up to one year at most; files you send out are deleted 30 days after the delivery expires. This is a transfer service, not a document archive.
Strong account security
Argon2id password hashing, TOTP and hardware-key (WebAuthn) multi-factor authentication, per-action re-verification, and new-device login alerts.
Built for Canadian privacy obligations
Minimum-necessary collection, audit logging, encryption, and automatic expiry are designed against PIPEDA, PHIPA, and Quebec Law 25 expectations. Compliance is ultimately yours to attest, but the technical controls a privacy officer asks about are here and documented.
Who can see what
Our staff can see account details and file metadata to run the service and answer support. Our admin tools cannot open file contents; a file is opened only at your written request or when the law compels it, and every such access is written to the audit log.
Canadian-owned and Canadian-hosted
The application, the database, and uploaded files run on servers owned and operated by a Canadian hosting company, on Canadian soil. This is the distinction that matters legally: a US-owned provider with a Canadian datacentre is still a US provider, and a US CLOUD Act order is served on the provider, not the building. There is no US-owned company in the custody chain of your files, so they are handled under Canadian legal process. That is not immunity from legal process - Canadian courts can compel production, and governments cooperate through treaty channels - but it does decide whose law applies. Email notifications leave through easyDNS, a Canadian company, and are then delivered to each recipient's own email provider, which may be outside Canada; see our Privacy Policy. Backups are encrypted and stored in Canada, on backup storage we operate in Ontario.
Every vendor that touches personal data on our behalf is named, with what it can see and where it operates, on our sub-processors page. Found a security issue? Our responsible disclosure policy says how to report it.
Have a security question or want to report a concern? Email support@receivevault.com.