Security

This page documents how SteadyLink handles files, credentials, and access from the first upload through delivery, including the parts of security that remain under your control.

Last reviewed August 19, 2026

Overview

SteadyLink receives file bytes, checks them, stores each accepted revision, and serves the revision selected by the workspace without making an upload deliverable before validation and scanning are complete.

Accounts
Authentication, workspace membership, roles, and scoped credentials.
Files
Upload validation, malware scanning, encrypted storage, and revision history.
Delivery
Visibility rules, expiring signed links, and authorized private access.

Upload path

Dashboard and API uploads use the same completion path, where the client receives short-lived permission for the intended file and the revision remains unavailable until every required check finishes.

  1. 1Access checkedThe request must belong to an authorized workspace member or scoped API client.
  2. 2Upload authorizedPermission is short-lived and limited to the intended upload rather than acting as a reusable storage credential.
  3. 3File validatedSize, type, and workspace upload rules are checked before the revision can proceed.
  4. 4Malware scan completedUploaded bytes are scanned for malware, and a failed, infected, or blocked file does not become live.
  5. 5Revision made readyOnly a revision that passed the required checks can be selected for delivery.

Identity and access

Authentication establishes the user or API client, while workspace membership, roles, and API scopes determine what that identity can read or change.

Passwords

Passwords go through a modern one-way hashing process, which means the original password is never stored.

Sessions

Access tokens are tied to sessions that can expire or be revoked, and a password reset revokes existing sessions.

API keys

Secret keys are displayed once, protected in storage, scoped to one workspace, and limited by explicit permissions.

Workspace roles

Owner, admin, member, and viewer roles control access to files, settings, and administrative actions.

Storage and encryption

Stored files and metadata are encrypted at rest, while uploads, API calls, dashboard traffic, and file delivery use encrypted connections in transit with access limited to what is needed to operate SteadyLink.

SteadyLink is not end-to-end encrypted because the service must process file bytes to scan, transform, version, and deliver them, so use client-side encryption when only the recipient should be able to decrypt a file.

File delivery

A stable asset URL resolves to the revision selected by the workspace, so replacing or rolling back a file changes that selection without overwriting its revision history.

  • Public files: readable by anyone with the URL.
  • Private files: require an authenticated and authorized API request.
  • Signed links: grant time-limited access to a specific private resource.
  • Cached delivery: follows the current visibility and revision rules while replacement and rollback update the live selection without deleting older revisions.

Operations

  • Audit records: sensitive workspace and file actions record the actor, action, time, target, and request ID.
  • Request tracing: requests carry identifiers so failures and suspicious activity can be investigated.
  • Rate limits: shared production limits reduce automated abuse across the service.
  • Browser protections: production responses use restrictive transport, framing, content, and browser permission policies.
  • Resource limits: upload, conversion, and workspace quotas reduce accidental exhaustion and automated abuse.

Security boundaries

SteadyLink protects the platform and enforces each workspace's rules, while workspace owners remain responsible for:

  • Choosing the correct public or private visibility for each file.
  • Removing members and revoking API keys that no longer need access.
  • Keeping exported keys and signed links out of public source code and logs.
  • Confirming that uploaded content may legally be stored and delivered.
  • Using client-side encryption when SteadyLink must not be able to process the plaintext.

Report a security issue

Email a clear description, the affected URL, and steps to reproduce the issue without including customer files, passwords, API keys, or personal data in the initial report.

[email protected]

Related: Privacy policy