Security
A preview is not a copy.
Six layers stand between your client and a free download. Each one is on by default and scales with your plan, and the originals never leave until you release them.
Dunes at golden hour, final selects
248 RAW files / 31.4 GB
Originals locked until paid
Final balance $1,840.00
Moire capture shield, live
A sub-pixel grating flips phase every frame. Your eye averages it away; a phone camera folds it into rainbow banding. Press Simulate phone camera to see it.
Forensic trace in the pixels
Every viewer gets a copy whose lowest bits carry their session. Lift the file out of DevTools and it still names who opened it.
Blur when focus leaves
Snipping tool, tab switch, screen overlay: the preview drops behind a 40px blur and the attempt is logged.
// any extension, any script canvas.toDataURL() => "data:,"
WebGL isolation
Previews live only as GPU textures. A save-image click or a page script reading the canvas gets a blank.
900s
Links that expire in 15 minutes
Every storage URL is signed and short-lived. A forwarded link is a dead link.
Bound to the first device
Optionally lock a gate to the client's network and browser. Forward it to a friend and it opens nothing.
Under the hood
Locked down from storage to the last click.
What protects your files and your clients' details when nobody is looking at a preview.
Encrypted at rest
Every file and every receipt in Cloudflare R2 is encrypted with AES-256.
Encrypted in transit
Dashboards, client pages and every API call run over TLS 1.3.
Links that expire
Preview and download URLs are signed and expire after 15 minutes, so hotlinking and static sharing fail.
Session binding
Optionally bind a gate to the client's first network and browser, so a forwarded link opens nothing.
Verified billing events
Paddle and Xendit webhooks are verified on the raw request before anything is read, and each event is applied once.
Private receipts
Receipts sit in private storage, readable only by you and the client who sent them, and are deleted 90 days after release.
Straight talk
What no web page can fully stop, and what we do about it.
A determined client can still point screen-recording software at a preview. The tiled watermark names them in every frame, the moire shield ruins phone photos of the screen, and the forensic trace identifies exact copies of images.
None of that touches your originals: they stay locked in storage until you check your own account and press Release.