Security
Security you can explain to your client
Every drop is protected by layers you control, on infrastructure built to stop attacks at the edge.
Encrypted everywhere
TLS for every connection and encryption at rest for every stored file.
Vault: end-to-end encryption
AES-256-GCM in the browser. The key lives only in the link fragment and never reaches our servers.
Access you choose
Public, passcode, invite-only with email verification, or burn after reading. Revoke or rotate links instantly.
Expiry by default
Drops expire and are deleted from storage automatically. Nothing lingers by accident.
Malware scanning
Uploads are checked against known-bad hashes and scanned with an antivirus engine. Flagged files are blocked.
Isolated content domain
Files are served from slingdropcontent.my, a separate domain with sandboxing and strict content types, so a shared file can't touch your session.
Watermarks
Overlay or burned-in watermarks with the viewer's email deter leaks.
Passwordless sign-in
One-time codes, magic links, Google and Apple. Passcodes are hashed with PBKDF2 and rate limited.
Cloudflare edge
DDoS protection, rate limiting and isolation between customers, on Cloudflare's global network.
Audit logs
Team plans record views, downloads and permission changes, exportable as CSV or JSON.
Privacy by design
No ads, no selling data. Export or delete your account and data at any time.
Responsible disclosure
We welcome reports from researchers and respond quickly.
Reporting a vulnerability
Email support@slingdrop.my with “Security report” in the subject. Include steps to reproduce and the impact. We acknowledge reports within two business days and keep you updated until it's fixed. Please don't access other people's data, degrade the service or publicly disclose before we've had a chance to fix the issue. Our security.txt has the details.