Your archive, kept safe and kept private.
Here is what protects your files, in plain terms, including what we do not do. We would rather you know exactly how it works than take our word for it.
How your files are protected
Encrypted in transit
Everything between your browser and Oneloft travels over HTTPS (TLS).
Encrypted at rest
Files are stored on Amazon S3 with AES-256 server-side encryption. Amazon designs S3 for 99.999999999% (eleven nines) durability.
No passwords to leak
You sign in with an emailed link or code, or with Google. There is no Oneloft password to steal or reuse.
Short-lived access
Previews and downloads are served with short-lived signed access that only your browser can use, and it expires.
Private folders
Mark files and folders private and they are hidden from lists and search until you unlock them with a one-time code we email you. The unlock lasts 15 minutes.
Payments stay with Stripe
Card details go straight to Stripe. They never touch our servers.
What we don’t do
We don’t sell your data
Your files and your personal data are never sold or rented, and we show no advertising.
We don’t train AI on your files
Your files are not used to train artificial intelligence or machine learning models.
We don’t look inside your files
We store and deliver them. We access stored data only to run, secure and support the service, at your request, or where the law requires.
We don’t claim end-to-end encryption
Oneloft is not end-to-end encrypted: encryption keys are managed for us by our infrastructure provider. Private is a visibility setting that adds a barrier in the app; it does not change how the file is encrypted.
Where your data lives
All files and account data are stored on Amazon Web Services in the United States (US East, N. Virginia). Backups of our database are kept for up to 35 days, and a file you delete is permanently removed after its 30 days in Deleted files, with our storage keeping a protected copy for up to about 7 days longer before it is erased.
Keep a second copy of what you can’t replace
Oneloft is built on infrastructure designed for very high durability, but no service can promise that nothing will ever go wrong. For anything irreplaceable, keep another copy somewhere else. Oneloft is an archive for what you keep, not your only copy of it.
Report a security issue
If you think you have found a vulnerability, email support@oneloft.io with the details. We will acknowledge it, look into it and keep you informed. Please give us reasonable time to fix a problem before sharing it publicly, and do not access other people’s data.
More detail
Our Privacy Policy explains what personal data we collect and how long we keep it, and our Terms of Service set out how the service works and our responsibilities to you.