Trust

Security

Bidadari Drop treats every uploaded file as hostile. The goal is not to promise that no bad file is ever uploaded, but to make sure a bad file cannot run, spread or reach anything else.

How files are handled

• HTTPS is used for all traffic.
• Private storage. Files are kept outside the web-accessible folders. There is no URL that points at a stored file.
• File type restrictions. Only a short list of document, image and text types is accepted, and the content must match the type. Scripts, web pages, executables and macro-enabled documents are refused.
• Downloads only. Files are always delivered as attachments and are never displayed, previewed or opened by the service.
• Encrypted at rest. Stored files are encrypted on the server. This is not end-to-end encryption.
• Limits and expiry. Uploads and password attempts are rate limited, and Drops expire automatically.
• Hosting protection. The hosting platform adds its own network and malware protections. We treat those as an extra layer, not a replacement for the controls above.

What we do not claim

Bidadari Drop does not scan files and does not say that a file is free of malware. Only open files from people you trust.

Responsible disclosure

Found a vulnerability or want to report abuse? Email hello@bidadari.app. Please give us reasonable time to fix an issue before sharing it, and do not access other people’s data.