Security

Your files are stored in your own Zoom account. FileSend streams them to your recipient and never saves them on our servers. We do not claim end-to-end encryption; files are protected by Zoom's storage and TLS in transit.

Where files live

Every file you send or receive is uploaded into a private FileSend space in your own Zoom Team Chat, using your Zoom authorization. When a recipient downloads, our server fetches the bytes from Zoom with your token and streams them straight to their browser in memory. Zips are built on the fly. Nothing is written to our disks beyond a short-lived spool while an upload is in flight, which is wiped the moment the file reaches Zoom.

What we store

Your Zoom ID, name, email and encrypted OAuth tokens
Counterparty emails, encrypted at rest
File names, sizes, types, SHA-256 hashes and the pointer into your Zoom storage
Access events: action, time, IP, user agent

What we never store

File bytes
One-time codes in plain text (hash only)
Link tokens in plain text (hash only)
Thumbnails (rendered per request, never cached)

How links are protected

Link tokens are 32 random bytes, stored as SHA-256. A token alone reveals only the sender's name and the file count.
A 6-digit code is emailed to the address the link was issued to. It expires in 10 minutes, allows 5 attempts before a 15-minute lock, and at most 5 codes per hour per link.
Recipient sessions are scoped to one transfer, httpOnly and secure, with a 30-minute sliding timeout.
Expiry and revocation are checked on every request, so a revoked link dies instantly.
Portal uploads refuse executables and scripts, are malware-scanned before reaching Zoom, and are rate-limited per IP and per email.

Retention and deletion

Audit events are kept 30 days on Free and 2 years on Pro, then deleted. One-time codes are purged daily. When you uninstall FileSend from the Zoom Marketplace, we revoke every active link, cancel open requests, delete your tokens and personal data within Zoom's deadline, and keep only anonymised counts. Files already in your Zoom account stay there; they are yours.

Zoom permissions

FileSend requests only user-level scopes: your profile and email, the Zoom Apps surface, the Team Chat bot, Team Chat file upload and download, the private FileSend channel, and your Marketplace plan. No admin scopes.

Security questions or disclosures: support@filesend.app