Security is the foundation
of every feature

Every measure listed here is live in the product — not marketing copy.

• Strict upload validation — Real file types are verified from magic bytes — never trusting extensions — and every image is re-encoded to eliminate hidden, potentially dangerous payloads.
• Encrypted connections — All traffic between you and Uppic is encrypted with HTTPS/TLS.
• Isolated object storage — Files live in object storage separated from the web servers, with system-level access control.
• Access control — Per-image privacy levels — Public / Unlisted / Private — with Private images served through an authorization check every time.
• Scoped links — Private file access uses links tied to authentication, not permanent public URLs.
• EXIF controls — Sensitive metadata such as GPS coordinates is stripped by default — you choose what to keep or remove.
• QR destination validation — QR and redirect destination URLs are safety-checked, blocking dangerous destinations and internal-network targets.
• Malware protections — Known-bad files are detected and blocked, with rate limiting against abnormal request floods.
• Two-factor authentication (2FA) — TOTP 2FA adds a second layer even if a password leaks — and passwords are always hashed with Argon2.
• Device session control — See every signed-in device and revoke unfamiliar sessions instantly from the Dashboard.

• Internal system access follows least-privilege principles.
• Dependencies and libraries are updated and audited for vulnerabilities regularly.
• Audit logs record significant actions that affect data.
• Backups rotate on schedule with restricted access.