Security

1. Overview

VIP Blocks, LLC (“WebUploads,” “we,” “us”) builds and operates a B2B file collection and sharing platform: upload request links, short download links, team workspaces, storage, usage analytics, and subscription billing.

Our security approach emphasizes:

• Protecting Customer Content — the files and related metadata you entrust to the Services;
• Defense in depth — Cloudflare’s global edge and platform security, encrypted transport, access controls, and operational monitoring;
• Least privilege — internal access limited to what is reasonably needed to run, secure, support, and investigate abuse on the product;
• Customer-configurable controls — link settings, team membership, and workspace configuration you own;
• Transparency — clear documentation of practices and a path to report issues.

No online service is perfectly secure. We work continuously to reduce risk and respond when issues arise. You remain responsible for how you configure workspaces, secure your email for sign-in, and distribute upload or download links.

2. Infrastructure

WebUploads runs on Cloudflare end to end. We build and operate this platform on Cloudflare’s global network — not a patchwork of secondary clouds for core compute and data. That includes:

• Cloudflare Workers — application logic, APIs, and serverless processing at the edge;
• Cloudflare R2 — object storage for customer files and related Customer Content;
• Cloudflare D1 — relational application and metadata storage (accounts, links, subscriptions, and similar records);
• Cloudflare edge network — DNS, CDN/delivery, TLS termination, DDoS mitigation, WAF and bot protections (where configured), and related platform services.

Cloudflare is a publicly traded, security-first enterprise infrastructure company that protects a substantial share of the public internet. By standardizing on Cloudflare for compute, storage, and edge defense, we inherit a strong operational and security baseline: global anycast, continuous investment in network security, enterprise-grade platform controls, and a vendor whose core business is keeping services fast and safe at scale.

Environments are separated (for example, production vs. non-production) so that development and testing do not share production Customer Content by default. We do not operate customer-facing data centers ourselves; physical and environmental controls for the underlying platform are provided by Cloudflare as part of its global infrastructure.

Learn more about Cloudflare’s security and privacy posture at Cloudflare’s Trust Hub and Cloudflare’s Privacy Policy.

3. Encryption and data protection

• In transit. Client connections to WebUploads web properties and APIs are protected with TLS (HTTPS). We aim to use modern TLS configurations and redirect cleartext HTTP to HTTPS where we control the endpoint.
• At rest. Customer Content and primary application data on Cloudflare services we use (including R2 object storage and D1 databases) are protected using Cloudflare’s platform encryption and storage security controls. Exact mechanisms may evolve as Cloudflare and our configuration change; we rely on Cloudflare’s enterprise storage and platform defaults as a foundation.
• Object access. File uploads and downloads prefer short-lived, scoped presigned URLs to R2 rather than long-lived public object URLs. Object keys are scoped under account-oriented prefixes (for example per owner workspace) to reduce accidental cross-tenant path exposure in application logic.
• Secrets. Application secrets (such as JWT signing keys and Stripe webhook secrets) are stored using Cloudflare secrets / environment secret management — not committed to public source control.
• Backups. Where we maintain backups for durability and recovery, they are stored with access controls and encryption consistent with our production data practices, and retained for limited operational periods.

Encryption reduces risk; it does not eliminate it. Compromise of an email inbox used for OTP login, stolen session cookies, leaked download codes, or overly broad upload links can still expose content to unauthorized parties.

4. Identity and access

4.1 Authentication

WebUploads does not use account passwords. Users sign in with their email address and a one-time passcode (OTP) delivered to that email, then maintain a secured session. That design avoids password reuse and credential stuffing against stored passwords. OTP codes are short-lived; we apply rate limiting on login and verification endpoints to reduce brute-force and abuse risk.

4.2 Sessions

After successful verification, we issue a signed session token (JWT) stored in an httpOnly cookie so client-side scripts cannot read it. Dashboard routes require a session cookie; APIs verify the token before performing authenticated actions. Sessions expire after a limited period and may be invalidated when we rotate signing secrets or take enforcement action.

4.3 Authorization

Within a workspace, access is limited to the account owner and team members who have accepted a secure invite. Team members share the owner’s workspace according to product roles and invite acceptance. Only authenticated, authorized users may manage files, links, settings, and billing for that workspace (subject to plan limits).

4.4 WebUploads personnel

Human access by our personnel to production systems and Customer Content is limited to operational need — for example fulfillment, security response, abuse investigation, troubleshooting with a legitimate need, and legal compliance. Access is subject to authentication, authorization, and confidentiality obligations. We do not browse Customer Content for advertising or unrestricted research. See also Section 10 and our Privacy Policy.

5. Product security controls

Security-relevant product capabilities may include (availability varies by plan and rollout):

• Paid access for product features — storage and transfer features are gated by active subscription where the product requires it, reducing anonymous abuse of unlimited free capacity;
• Storage and plan limits — enforced on authenticated and public upload paths so workspaces stay within purchased capacity;
• Team invites — membership via secure invite tokens rather than open join links;
• Upload request links — customer-controlled links for third parties to submit files, with expiry and other limits as the product supports;
• Short download links — compact codes with expiration so distribution is time-bounded when configured;
• Custom subdomains — branded hostnames for paid accounts, subject to acceptable-use and reclaim rules in our Terms;
• Usage analytics — visibility into uploads, downloads, and storage to help you spot unexpected activity.

Controls only work when configured correctly. Review team membership, open links, and subdomain settings regularly — especially after offboarding or large sharing campaigns.

6. Upload and download links

Upload request links and short download links are core product features — and the primary way content leaves a closed team boundary. Treat them as security-sensitive.

• Anyone with a working link may act as configured. Uploaders and download recipients often do not need a WebUploads account. If a link is forwarded, posted publicly, or logged in a chat system, unauthorized parties may use it until it expires or is revoked.
• Default workspace content is not public. Files in a workspace are not world-readable unless you (or an authorized user) create a link or otherwise enable sharing.
• Expiry and limits reduce risk. Use the shortest practical lifetime and the tightest limits the product allows for sensitive transfers. Expiry is not a guarantee that content was never copied by a legitimate recipient.
• Third-party uploads are associated with your workspace. Content submitted through your upload links counts toward your storage and is subject to our Terms and abuse policies. You are responsible for what you invite others to send.

7. Application security

We apply standard secure-development and runtime practices, including:

• Secure defaults — HTTPS, httpOnly session cookies, and careful handling of authentication state;
• CSRF-oriented protections — mutating authenticated APIs verify Origin / Referer against the application host (with local development exceptions) to reduce cross-site request abuse;
• Rate limiting — login and OTP paths use D1-backed counters (with fallback behavior) to slow credential stuffing and OTP flooding;
• Webhook authenticity — Stripe webhooks are verified with Stripe’s signature mechanism before we update subscription state;
• Privileged operations — sensitive maintenance endpoints (for example cleanup) require dedicated bearer tokens, not ordinary user sessions;
• Input handling — validation and encoding practices aimed at reducing common web risks in product surfaces we control;
• Dependency and secret hygiene — monitoring and updating third-party libraries as part of ongoing maintenance; secrets rotated via Cloudflare secret management;
• Principle of least privilege — service accounts and infrastructure roles scoped to required actions.

Security is iterative. As upload, download, team, and billing features evolve, we revisit controls and fix issues as we learn about them.

8. Payments

Paid plans are processed through Stripe hosted Checkout, the Stripe Customer Portal, webhooks, and related Stripe payment services. Sensitive payment card data is handled by Stripe; we do not store full card numbers on WebUploads systems when Checkout is completed via Stripe. We typically retain limited billing metadata needed to manage subscriptions, refunds, and accounting (for example Stripe customer and subscription identifiers, plan status, and limited payment method metadata).

See Stripe’s Privacy Policy and our Privacy Policy for how payment-related information is processed.

9. Email delivery

OTP codes, service notifications, and other product email are dispatched through email delivery providers rather than self-hosted mail servers:

• Primary — Cloudflare Email Sending. Aligned with our Cloudflare-first infrastructure, we use Cloudflare’s email sending capabilities to deliver transactional and notification email, including authentication codes.
• Backup — Twilio SendGrid. We may maintain Twilio SendGrid as a secondary provider so we can fail over and continue sending critical messages (for example OTPs, security alerts, account notices, and billing-related mail) if the primary path is degraded or unavailable.

These providers process recipient addresses, message content, and delivery metadata solely to transmit email on our behalf. Because sign-in depends on email delivery, protecting your inbox is part of account security. See our Privacy Policy for privacy details and links to Cloudflare’s Privacy Policy and Twilio’s Privacy Notice.

10. Abuse and content review

We do not actively open every file stored on the Services. We do reserve the right to access, scan, preserve, remove, or disable Customer Content and accounts when investigating reports of abuse, malware, illegal activity, Terms violations, security incidents, or when required by law. Those rights are described in our Privacy Policy and Terms of Service.

Automated or manual review for abuse does not guarantee that all harmful content will be detected. Report suspected abuse at support@webuploads.com.

11. Operations and monitoring

• Logging and telemetry. We collect operational logs, performance metrics, and security-relevant events to run, troubleshoot, and protect the Services. Analytics (including Cloudflare Analytics and Google Analytics on applicable properties) help us understand usage and reliability; details are in the Privacy Policy.
• Product metrics. First-party usage data (for example upload/download counts and storage) supports plan enforcement and account dashboards.
• Alerting. We monitor for availability and anomalous behavior that may indicate abuse or incident conditions.
• Change management. Material production changes are intended to go through controlled deployment processes.
• Vendor management. Our core infrastructure and primary email vendor is Cloudflare. Other critical subprocessors (for example Stripe for payments, Twilio SendGrid as backup email delivery, and analytics providers) are selected with security and reliability in mind and bound by contractual obligations appropriate to their role.
• Lifecycle cleanup. We run maintenance jobs (for example expired-link cleanup) under restricted credentials to reduce lingering access paths.

12. Incidents and vulnerability reports

12.1 Incident response

If we become aware of a security incident affecting Customer Content or the confidentiality, integrity, or availability of the Services in a material way, we will investigate, take steps to contain and remediate, and notify affected customers as required by law and our contractual commitments. Notification timelines and channels depend on the nature of the incident and applicable obligations.

12.2 Reporting a vulnerability or suspected breach

If you believe you have found a security vulnerability in WebUploads, or suspect unauthorized access to an account or Customer Content, contact us promptly at support@webuploads.com with:

• A clear description of the issue and potential impact;
• Steps to reproduce (for vulnerabilities) or evidence of suspicious activity;
• Your contact information for follow-up;
• Whether you have already shared the finding with others.

Please act in good faith: do not access data that is not yours, do not degrade the service, and give us a reasonable opportunity to investigate before public disclosure. We appreciate responsible reports and will work with researchers who follow those norms.

13. Your responsibilities

Security is shared. You agree to:

• Protect the email inbox used for OTP sign-in, sign out of shared devices, and treat active sessions as sensitive;
• Configure team membership, upload links, download links, and subdomains appropriately;
• Treat link URLs and download codes as secrets when content is sensitive;
• Offboard users and revoke or expire links when people leave or campaigns end;
• Keep Customer Content lawful and free of secrets or regulated data you are not allowed to store in the Services;
• Maintain independent backups when your use case requires them;
• Promptly report suspected compromise of your account, email, or links;
• Comply with our Terms of Service and applicable law.

14. Compliance and assurance

We design the Services with common security and privacy expectations in mind (for example, encrypted transport, access control, and subprocessors under contract). Formal third-party certifications, attestations, or audit reports (such as SOC 2) may be pursued or available as our program matures; this page does not claim a specific certification unless we publish that claim separately with supporting detail.

Enterprise customers may request additional security questionnaires or documentation under NDA where appropriate. Contact support@webuploads.com for business security reviews.

Regulated workloads (for example certain health (HIPAA), payment card (PCI), or government-classified data) require explicit written agreement that the Services are suitable for that use. Do not assume the standard product is certified for every regulatory regime. Card payments themselves are processed by Stripe under Stripe’s compliance program; that does not make WebUploads a PCI-certified file vault for cardholder data files you might upload.

15. Related policies

• Privacy Policy — how we collect, use, and share personal information;
• Terms of Service — contractual terms for using WebUploads;
• Accessibility — our accessibility commitment and contact path;
• Contact — general support contact details.

We may update this Security page as our product and practices evolve. Material changes will be reflected in the “Last modified” date above.

16. Contact

Security questions, vulnerability reports, and incident notices:

Mailing address (single line): VIP Blocks, LLC, 944 Deltona Blvd #5096, Deltona, FL 32725. This Security page describes practices in good faith for transparency. It does not expand warranties or liability beyond our Terms of Service and any separate written agreement with VIP Blocks, LLC.