Question 1

How are my files encrypted?

Accepted Answer

SecuFile uses end-to-end (E2E) encryption with the AES-256-GCM algorithm. Your files are encrypted before leaving your device and remain encrypted throughout their lifecycle (storage, transit, backup).Encryption process:Generation of a unique Data Encryption Key (DEK) AES-256 for each fileFile encryption with the DEK in GCM mode (Authenticated Encryption)The DEK is then encrypted by your organization's master key (KEK)Storage of encrypted file + encrypted DEK + metadataTLS 1.3 secures all communications in transit.

Question 2

Can SecuFile employees access my files?

Accepted Answer

No. When end-to-end (E2E) encryption is enabled, your files are encrypted in your browser before upload with AES-256-GCM. Our servers never see plaintext content and our employees have no technical means to decrypt your files.Key management options:Client-Side Encryption (Zero-Knowledge): Your files are encrypted in your browser. The server only stores encrypted data.OVH KMS (Sovereign): Keys protected by OVH Cloud's HSM in Quebec for complete sovereignty.With client-side encryption enabled, only you can decrypt your files.

Question 3

Where is my data stored?

Accepted Answer

By default, all data is hosted in Quebec (Beauharnois) in the OVH Cloud BHS region data center. This choice guarantees:Law 25 compliance: Data under Quebec and Canadian jurisdictionDigital sovereignty: No US dependency (no CLOUD Act or FISA)Optimal latency: Proximity to Canadian usersEuropean option available:European customers can choose hosting in France (Gravelines) for strict GDPR compliance with data in the EU.No US option to ensure maximum protection of your data.

Question 4

Is SecuFile compliant with Law 25 (Quebec)?

Accepted Answer

Yes, fully. SecuFile complies with all articles of Law 25 which came into force on September 22, 2022:Local hosting: Data in Quebec (Beauharnois)Designated officer: privacy@secuaas.comClear policy: Simple and understandable termsExplicit consent: Before any data collectionCollection limitation: Only necessary dataGuaranteed rights: Access, rectification, erasure, portabilityIncident notification: CAI PIA completed: Privacy Impact AssessmentAudit logs: Retention 7 years minimumWe are also compliant with PIPEDA (Canada) and GDPR (Europe).

Question 5

What happens to my deleted files?

Accepted Answer

SecuFile applies a two-step deletion process:1. Soft Delete (Logical deletion)30-day quarantine: Deleted files remain recoverable'deleted_at' marking in databaseRecovery possible via interface or API2. Hard Delete (Permanent destruction)After the 30-day quarantine or upon explicit request:Deletion of encrypted file on S3Destruction of DEK key: Makes the file unrecoverable even if it was copiedMetadata purge in databaseCertificate of destruction: A cryptographically signed PDF certificate is generated with SHA-256 hash, timestamp and method used.

Question 6

How do you manage encryption keys?

Accepted Answer

SecuFile uses a three-tier key hierarchy:1. Master Encryption Key (MEK)Root key protected by OVH Cloud HSM (Hardware Security Module)Never exposed outside the HSM2. Key Encryption Keys (KEK)One key per organization, derived from MEK via HKDF-SHA256Used to encrypt DEKs3. Data Encryption Keys (DEK)Unique key per file (never reused)Randomly generated (256 bits)Encrypted by KEK before storageKey derivation: Using HKDF (HMAC-based Key Derivation Function) with SHA-256 to derive keys from source material.

Question 7

What are the access control features?

Accepted Answer

SecuFile implements RBAC (Role-Based Access Control) at multiple levels:1. Predefined rolesOrganization Admin: Complete organization managementManager: Group creation and shared folder managementUser: Upload, download, share personal filesGuest: Read-only access to shared files2. Granular per-file permissionsRead, Write, Delete, ShareACL (Access Control Lists) per user or group3. Multi-factor authentication (MFA)TOTP (Google Authenticator, Authy)Mandatory for admins, optional for usersWebAuthn/FIDO2 (YubiKey hardware keys) planned4. Secure share linksPassword protectionConfigurable expiration dateDownload limit restriction

Question 8

How can I try SecuFile?

Accepted Answer

SecuFile is available now. Create your free account in minutes.Free tier included:1 GB secure storageAES-256 end-to-end encryption100% Quebec hosting (Beauharnois)Law 25 and PIPEDA complianceAudit logsMulti-factor authentication (MFA)Paid plans available:Starter — for small teamsPro — for SMBsBusiness — for enterprisesEnterprise — custom, contact usSee our pricing page for details.

Frequently Asked Questions

Cookies & Law 25 Compliance