A Secure Layer in Front of Your Infrastructure
Six controls run on every file before a byte reaches your systems.
Upload Sources
- Web and mobile uploads
- Server and API uploads
- Import by URL
- Third-party integrations
May carry malware, embedded scripts, disguised and oversized files.
Six Controls Run Automatically on Every File
Malicious and invalid files are rejected here. Only clean, signed files pass through to your stack.
Your Infrastructure
- Your backend and APIs
- Cloud storage on S3, GCS, or Azure
- Global CDN delivery
Only validated, signed, access-controlled files.
Close the Six Attack Vectors at the Upload Layer
Pick an attack vector to see the safeguard that closes it.
Files Carrying Viruses, Trojans, or Spyware
A file that infects devices or internal systems the moment it is opened.
Stopped by Malware and virus scanning. Security documentation →
Scripts Embedded in an Uploaded File
An SVG or HTML fragment that executes in the browser when it is served back.
Stopped by MIME validation and script stripping. Security documentation →
Payloads Engineered to Encrypt and Spread
A file built to encrypt systems and move laterally once executed.
Stopped by Malware scanning and signed delivery. Scan inside a workflow →
Infrastructure Reached Through a File Input
Attackers probe the code that handles uploads: parsers, image libraries, archive extractors.
Stopped by An isolated ingestion layer. How ingestion works →
Files Read or Written Without Authorization
Weak controls let an attacker download, overwrite, or enumerate files they should never see.
Stopped by Tokenized URLs and policy signing. Policies and signatures →
Import by URL Turned Against the Network
A supplied URL fetched without restriction reaches internal endpoints and metadata services.
Stopped by URL-fetch allow-listing. Store by URL →
Secure Uploads in Your Language
One SDK gives you the whole pipeline: validation, scanning, policy signing, signed delivery.
- Server-side policy signing, so the application secret stays on your server
- Scoped, expiring tokens on every request
- Type and size allow-lists enforced at the ingestion layer
const client = filestack.init('YOUR_API_KEY');
// policy and signature are generated server-side
client.picker({
security: { policy, signature },
accept: ['image/*', 'application/pdf'],
maxSize: 25 * 1024 * 1024,
onUploadDone: (res) => {
console.log(res.filesUploaded); // scanned and signed
},
}).open();
# the app secret stays on your server
security = Security(policy, app_secret)
client = Client('YOUR_API_KEY', security=security)
filelink = client.upload(filepath='contract.pdf')
print(filelink.handle) # scanned and signed
<PickerOverlay
apikey="YOUR_API_KEY"
clientOptions={{ security: { policy, signature } }}
pickerOptions={{
accept: ['image/*', 'application/pdf'],
maxSize: 25 * 1024 * 1024,
}}
onSuccess={(res) => console.log(res.filesUploaded)}
/>
use Filestack\FilestackSecurity;
// the app secret stays on your server
$security = new FilestackSecurity($app_secret);
$client = new FilestackClient($api_key, $security);
$filelink = $client->upload('contract.pdf');
echo $filelink->handle; // scanned and signed
Built to Pass Your Security Review
Documented, audited, and enforced by default.
SOC 2 Type II Certified
Controls tested over a period, not on a single day. That is the distinction a Type II report makes.
TLS Encryption in Transit
Encrypted in transit both ways, and at rest in storage.
HMAC-SHA256 Policy Signing
The signature covers the allowed calls and the expiry. Alter either and it stops matching.
Activity Logs for Audit Trails
Upload and access history per file. A bucket policy shows what was permitted, this shows what happened.
Secure File Upload Architecture, Written Out
Secure vs. Regular Document Upload Apps
IBM put the average breach at USD 4.88M in 2024. Why a secure upload path is now a compliance requirement.
Implementing Secure File Delivery
Signed URLs, expiry windows, and the headers that decide how a file is rendered.
Securing Web App File Delivery With Webpack
Wired into a build you already have.
Frequently Asked Questions
Does the file reach my backend before it is scanned?
The file never reaches your backend unscanned. Validation, scanning, and signing run in the ingestion layer, between the client and your infrastructure. A file that fails a check is rejected there, so your servers only handle files that already passed every control.
What stops a file that is disguised as another type?
MIME type and file signature validation. The declared type is checked against the actual bytes at the head of the file, so an executable renamed as a PDF is caught by its signature rather than its extension.
How are delivery URLs protected?
Delivery runs on signed URLs. A policy scoping the allowed calls and the expiry is signed server-side with HMAC-SHA256, so a URL cannot be altered or reused outside its window. The application secret stays on your server.
Can an import-by-URL feature be pointed at internal endpoints?
URL fetching is allow-listed, which is the control that closes server-side request forgery through a file input. A supplied URL that resolves to an internal endpoint, a cloud resource, or a metadata service is not fetched.
What can I hand to a security reviewer?
SOC 2 Type II certification, TLS encryption in transit, HMAC-SHA256 policy signing, and activity logs covering upload and access history per file. All four are enforced by default rather than configured per project.
Complete Upload Security in One API
Filestack validates, scans, and signs every upload automatically, and intercepts malware, ransomware payloads, and script injections at the ingestion layer.