Your providers hold your files. They can’t read them.

Encrypted on the way

As a file streams through Storsum’s server to your provider, it is encrypted with AES-256-GCM. Every file gets its own random key.

Providers see only scrambled data

An encrypted file is stored under a meaningless name such as 3f2a….enc. Its real name, type and size stay in Storsum’s database, so a provider can’t tell what it is.

Every piece is checked

Encrypted files are sealed in 256 KiB pieces. Each download checks every piece it reads, so a byte changed at the provider is caught rather than handed to you.

Who holds the keys

Each file’s key is itself encrypted with the server’s key and kept in Storsum’s database. It never goes to a provider, and the app and the API never show it.

Your choice, per upload

Each upload asks whether to encrypt. A file you don’t encrypt is stored as it is, under its real name, so you can also open it in the provider’s own app. You can encrypt or remove encryption later; the old copy is deleted only after the new one is stored.

Nothing kept on the server

Uploads and downloads stream straight through. File contents are never written to the server’s disk.

Access to your accounts

The tokens that let Storsum reach your storage accounts are stored encrypted. Sign-in sessions and API keys are stored only as hashes, so a copy of the database doesn’t give them away.

Links you control

Share links are long random tokens, and you can stop one at any time. Previews in the apps use links that stop working after ten minutes.

Deleting

Deleted files wait in Trash. They are removed from your provider only when you delete them for good.

Worth knowing: Storsum isn’t end-to-end encrypted. Because Storsum’s server holds the keys, it can decrypt your files to send them to you, show previews and share links. Your storage providers can’t.