Security
How your files are handled
- Uploads are stored under random keys in a private bucket. There is no public URL — downloads use signed links that expire in minutes.
- Every upload is identified by its actual contents, not its file name. Disguised executables are refused and PDFs are stripped of JavaScript and automatic actions before anything else touches them.
- Files are encrypted in transit, and at rest where the storage backend supports it.
Accounts
- Passwords are hashed with Argon2id. Sessions, API keys and share links are stored only as keyed hashes, so a database dump cannot be replayed against the service.
- Two-factor authentication is available, with single-use backup codes.
- Changing your password signs out every other device and sends you an alert.
What our systems never do
- Recognised text is never written to logs or sent to analytics. That is enforced in the logging layer and by a server-side allow-list, not by convention.
- When an AI model is used, your document is passed as data inside explicit markers. The model has no tools available to it, so instructions hidden inside a document cannot cause an action.
- Support staff see job metadata, never document content.
Reporting a vulnerability
- Email security@picglot.ru. We aim to acknowledge within two business days. Please give us time to fix an issue before disclosing it.