[ Security ]
Private by default. Shared on your terms.
Every file you upload starts private. A share link is a decision you make, with the controls to limit, expire or revoke it whenever you need to.
[01] Files
How Polu protects files
The same protections apply on every plan.
- 01
Private storage by default
Files are stored in private Cloudflare R2 buckets with no public access, and are encrypted at rest by the storage provider.
- 02
Short-lived signed URLs
Previews and downloads are served through signed URLs that expire within minutes, so a copied file URL stops working quickly.
- 03
Encrypted in transit
Every connection to Polu, the app, share pages and file delivery, uses HTTPS with TLS.
- 04
Malware scanning
Uploads are scanned for malware. Files that are flagged cannot be previewed or downloaded by recipients.
[02] Links
Access controls you set
Choose how open each link is. Some controls depend on your plan.
- 01
Passwords and email gates
Require a password, or ask recipients for their email before they can open a link. Passwords are stored only as hashes.
- 02
Expiry and instant revoke
Set an expiry date or view and download limits, and revoke a link at any time. Revoked links stop working immediately.
[03] Platform
Platform safeguards
- 01
Rate limiting
Sign-in, password unlocks, downloads and abuse reports are rate limited to slow down brute-force and scraping attempts.
- 02
Bot protection
Public forms such as abuse reports are protected with Cloudflare Turnstile.
- 03
Locked-down database
The database has no public endpoint and browsers have no direct table access. Data is read only by our servers, after checking your workspace permissions.
- 04
Audit logs and sessions
Sensitive account and workspace actions are recorded in audit logs. You can review and sign out active sessions from Settings.
- 05
Hashed IP addresses
We never store raw IP addresses. Visitor and session IPs are saved only as salted hashes, used to count unique visitors and detect abuse.
[04] Questions
Security FAQ
Who can open my share links?
Anyone who has the link can open it, unless you add a password or an email gate. Links stop working when they expire, reach their limit or are revoked.
Is Polu end-to-end encrypted?
No. Files are encrypted in transit and at rest, but our servers process them to scan for malware and generate previews. Don't use Polu for data that must be end-to-end encrypted.
Are analytics and session replay on by default?
No. Product analytics and session replay only run after you opt in through the cookie banner or Cookie settings. Share link activity for senders uses hashed IP addresses.
How do you handle abuse and takedowns?
Anyone can report a link. Our trust and safety team reviews reports and can disable links, block files and suspend accounts. Copyright notices follow our DMCA Policy.
Can I export or delete my data?
Yes. Signed-in users can export their data and delete their account from Settings. Deleted accounts can be restored for 30 days before data is permanently removed.
Do you have security certifications?
Polu does not currently hold SOC 2 or ISO 27001 certification, and customer-managed encryption keys are not available.
[05] Disclosure
Found a vulnerability?
Email support@polu.io with the details and steps to reproduce. Please give us reasonable time to fix the issue before sharing it publicly, and don't access data that isn't yours. To report abusive content instead, use the abuse report form.