Security is the foundation
of every feature
From the moment a file is uploaded to the moment a link is opened, every step of Uppic is designed with the safety of your data first.
What the system does to protect you
Every measure listed here is live in the product — not marketing copy.
Strict upload validation
Real file types are verified from magic bytes — never trusting extensions — and every image is re-encoded to eliminate hidden, potentially dangerous payloads.
Encrypted connections
All traffic between you and Uppic is encrypted with HTTPS/TLS.
Isolated object storage
Files live in object storage separated from the web servers, with system-level access control.
Access control
Per-image privacy levels — Public / Unlisted / Private — with Private images served through an authorization check every time.
Scoped links
Private file access uses links tied to authentication, not permanent public URLs.
EXIF controls
Sensitive metadata such as GPS coordinates is stripped by default — you choose what to keep or remove.
QR destination validation
QR and redirect destination URLs are safety-checked, blocking dangerous destinations and internal-network targets.
Malware protections
Known-bad files are detected and blocked, with rate limiting against abnormal request floods.
Two-factor authentication (2FA)
TOTP 2FA adds a second layer even if a password leaks — and passwords are always hashed with Argon2.
Device session control
See every signed-in device and revoke unfamiliar sessions instantly from the Dashboard.
Behind the scenes
- Internal system access follows least-privilege principles.
- Dependencies and libraries are updated and audited for vulnerabilities regularly.
- Audit logs record significant actions that affect data.
- Backups rotate on schedule with restricted access.
Found a vulnerability? Tell us first
We are grateful to security researchers who help make Uppic safer. If you find a vulnerability, please report it responsibly via the contact page using the Security category — we will investigate and respond as quickly as we can.
- 1Report via /contact with the Security category, including steps to reproduce.
- 2Give us time to investigate and fix before any public disclosure.
- 3Avoid accessing other users' data, destroying data, or testing in ways that disrupt the service.