Security
What's actually in place today — no invented certifications, no roadmap items presented as shipped.
Upload & file security
Antivirus scanning
Every upload is scanned before it's ever marked ready. Infected files are quarantined automatically, never served.
Content moderation
Automatic detection flags explicit content before it reaches your users, with an optional AI layer that can only strengthen a flag, never weaken it.
Private by default
Every upload starts private, readable only with a valid API key or session. Public delivery is something you opt into per file.
Access control
Scoped API keys
Per-project, per-environment keys with granular scopes — shown once, never stored in plaintext, revocable at any time.
Team roles
Owner, admin, developer, viewer — every existing endpoint enforces the same role matrix, not just the newest ones.
Project isolation
Data, API keys, and webhooks are scoped to a project — development, staging, and production never share credentials.
Network & delivery
Signed URLs
Private files are only ever served through time-limited, unforgeable signed links — never a permanent public URL by accident.
Webhook signing
Every webhook delivery is signed with HMAC-SHA256 over the timestamp and raw body — verify it before trusting the payload.
TLS everywhere
The shared CDN and every verified custom domain get a TLS certificate — ownership is checked over DNS before any certificate is issued.
Reliability, honestly
UploadCenter is a young, actively developed platform — we don't have years of uptime history to point to, and we won't invent a number. There's no formal SLA yet and no third-party security certification to date. If your use case needs contractual guarantees, reach out and we'll talk about what's realistic.