Security practices
How iShared.app protects your files and account data - encryption, authentication, access controls, and how to report a vulnerability.
This page describes the security controls actually in place today, not aspirational ones - it will be updated as more are added rather than describing a future state as current.
Encryption
- In transit. Every connection to iShared.app - the web app, the API, and file uploads/downloads - is served over HTTPS, with certificates automatically issued and renewed.
- At rest. Files are stored in a private Amazon S3 bucket with server-side encryption (AES-256) applied by default, versioned so an accidental overwrite isn't unrecoverable, and never publicly accessible - every access to a file goes through a signed, time-limited URL generated by our API, not a public bucket path.
Authentication
- Passwords are hashed with bcrypt before storage - we never store or can retrieve a plaintext password.
- Two-factor authentication is available to every account (an authenticator app or email codes, with backup codes), and can be required organization-wide by a Team or Enterprise owner.
- Single sign-on (SAML 2.0 and OIDC) is available on Team and Enterprise plans, with SCIM provisioning for Okta and Microsoft Entra ID so access is managed from your own identity provider. See our SSO setup guides.
- Sessions can be reviewed and individually revoked from Settings at any time.
Access controls
- Organization data is scoped by role (Primary Owner, Admin, Member) - see team roles and licenses.
- Verified company domains can be locked to require sign-in through your organization rather than self-service signup.
- Member and account lifecycle actions (invites, role changes, removals, suspensions) are recorded in an organization-level audit trail.
Abuse prevention
Authentication endpoints, MFA challenges, and public download links are all rate-limited to slow down credential-stuffing and brute-force attempts.
Data storage location
Application data and file storage currently reside in AWS's London (eu-west-2) region. We don't yet offer a choice of storage region - see compliance for where this sits on our roadmap.
Reporting a security issue
If you believe you've found a security vulnerability, please tell us before disclosing it publicly. Email details to security@ishared.app (or use Contact us if that's easier) - we'll acknowledge reports and work with you on a fix before any public disclosure.