Security and data handling: how your data and your sites are protected

This page summarises how Content Uploader handles security. The privacy policy and the Terms of Service are the binding texts; if they differ from this summary, they win.

Your account#

• All connections use HTTPS.
• Passwords are stored as one-way hashes. On the live service a new password needs at least 12 characters, mixed case, numbers and symbols, and must not be one known from data breaches.
• Two-factor authentication (authenticator app, with recovery codes) and passkeys are available, and you can sign in with Google, GitHub, Microsoft or GitLab. Two-factor secrets are stored encrypted. Changing how you sign in asks for your password again (password and sign-in).
• Sign-in attempts are limited (five a minute for one address from one connection), the sign-up, password-reset and feedback forms are protected against bots, and your Recent activity lists what happened to your account.

Your files and your workspace#

• Uploaded files are kept in private storage, separated by workspace, and are never publicly accessible. They are deleted 30 days after upload; run history is kept 12 months (what is kept).
• Where it is: servers and databases in the EU; uploaded files and encrypted database backups with Amazon Web Services in Frankfurt, Germany. Backups may hold deleted data until they are replaced.
• Who can open it: only the people in the workspace, and a team member only what belongs to the sites an owner gave them. Important actions are recorded in the workspace's activity history.
• Payments are made on Stripe's own pages, which are certified to PCI DSS Level 1; card details never reach Content Uploader's servers.

Your sites#

• No site password is ever requested. A connection is made once, from the plugin or extension on your site, by an administrator (connect a WordPress site, connect a Joomla site).
• The access key: a long random key exchanged directly between Content Uploader and your site. Your site keeps only a hash of it; Content Uploader keeps it encrypted. It lasts 90 days, can be renewed, and can be revoked at any time by disconnecting or deactivating the connector.
• Every request carries the key, a timestamp and a single-use number. A wrong key, an old timestamp or a number seen before is refused, so a copied request cannot be replayed.
• What the key can do: read what your site offers, read the state of items Content Uploader created, and create or update items. It cannot sign anyone in, read or change plugins, users or settings, or touch other files than the images it delivers.
• It works within one account's permissions, the administrator who approved the connection (WordPress) or the account chosen when connecting (Joomla), and your site checks them again on every operation. In WordPress nobody is signed in and the permissions are limited to content: a request can never install or change plugins or themes, manage users, change settings or edit files, whatever the administrator may do (permissions and authentication).
• Images are fetched by your site through a link that lives 15 minutes and are checked against a fingerprint of their content; SVG files, which can carry scripts, are never accepted.
• Content is written through your CMS's own functions, so its filters (which remove scripts and unsafe markup for accounts that may not post them) apply.
• Nothing is deleted on your site by publishing.

Team invitations#

An invitation link is a secret: only a hash of it is kept, it works once, for 7 days, and only for a signed-in account with the address it was sent to, confirmed. The pages that carry it are never cached, indexed or counted by analytics.

Reporting a problem#

To report a security vulnerability, follow the Terms. Do not send passwords, keys or recovery codes in a support request (support).