Security
This page describes what FilesDue does today. We only list practices that are in place now.
Not for medical records. Don't ask for or upload lab results, health claims, or other health data. FilesDue is not built for protected health information (PHI) or HIPAA use.
Storage
Each uploaded file is encrypted with AES-256-GCM by FilesDue before it is written to storage. Encrypted file data is kept in our Postgres database (hosted by Neon). All traffic to filesdue.com uses HTTPS.
Access
Each request gets a long random client link (256 bits). The link lets the client upload to that request and see its checklist. It can't be used to download files. Viewing and downloading files, including the ZIP, needs your signed-in FilesDue account. Session cookies are HttpOnly and SameSite=Lax.
Passwords and sign-in
Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, a random salt per password). Plain-text passwords are never stored. Sign-ins and uploads have basic rate limits.
File handling
Uploads are limited to common document types up to 100 MB each. Downloads are sent as attachments with nosniff, so files are never shown as web pages.
Retention
You choose to keep files 30, 60, 90, 180 days after a request is complete (default 90). After that, an hourly job deletes the files and the client link stops working. Requests that are still open are not deleted automatically.
Deletion
You can delete any request from its page, or everything at once under Billing → Your data. That removes the uploaded files from storage right away and turns off the client links. Deleting works even after you cancel. Cancelling alone does not delete anything. Database backups kept by our hosting provider may hold copies for a limited time until they expire.
Audit log
Sign-ups, sign-ins, request creation, uploads, downloads, deletions and retention purges are recorded.
What we don't claim
FilesDue has no third-party security certification such as SOC 2, and it is not built for PHI or HIPAA use. Billing is handled by Stripe; we never see or store full card numbers.
Questions about security or a report of a problem: hello@filesdue.com. See also our Privacy Policy.