Everything on this page links to something you can check.
Where your data lives
EU only. Hosting, database and object storage run on Hetzner in Germany/Finland; every other provider is on the sub-processor list. No data leaves the EEA.
How encryption works
Files are age files (an open format) whose payload is encrypted in 64 KiB chunks
addressed by index, so uploads resume and videos seek without decrypting the whole file. In
end-to-end encrypted mode the keys never leave your browser: the link key rides in the URL
fragment, account keys are wrapped under your passkey (WebAuthn PRF) and a recovery key. Standard
age decrypts a Vessio download. Specification:
docs/format.md; design decisions: the ADRs.
What it protects against, and what it does not
E2EE protects file contents against a storage breach, an insider, and a lawful-access request for content. It does not hide sizes, timestamps, addresses or account data, and it cannot protect against a Vessio server that serves malicious JavaScript — which is why the client is open source, the build is reproducible and every module is integrity-checked. Read the threat model.
Reproducible build
Each release publishes the hash of every client asset at
/.well-known/vessio-build.json, and pages carry an
import map that makes the browser refuse a module whose hash differs. This deployment:
3846f98c50370ea78ddef93c705bae4a55003e9c81202f05a1109904c3d46066, commit 9cd1d4bf67aa. Rebuild
it yourself: the runbook.
Security review
The encryption and transfer packages are frozen at version 1.0.0-review.1 for an
independent review. Until the review is published, E2EE is labelled “beta — under independent
review”.
Supported browsers
Measured, not guessed: the supported-browser table.
Scanning
Standard-mode files up to 2 GB are scanned with ClamAV and matched against malware hash lists; larger or encrypted archives are typed by magic bytes. End-to-end encrypted files are never scanned — account verification, rate limits and the report button take that role. Details: the scanning policy.
Reports and takedowns
Every download and portal page has a report button. Notices are reviewed within 24 hours; removals come with a statement of reasons and a redress path. Contact: abuse@vessio.eu. Procedure: the runbook.
Retention
| Data | Kept |
|---|---|
| Transfers and their files | Until expiry (7–90 days), then deleted; records 90 days more for the download log |
| IP addresses | 30 days, then removed; country kept |
| Sessions | Until expiry or sign-out |
| Abuse reports, takedown records | 12 months after closing |
| Deleted accounts | 30 days, then purged |
Status
Live checks on the status page.