End-to-End File Transfer Security: An in-depth guide to the security of EZ File Drop

EZ File Drop was built with security as a primary design focus. This begins with using HTTPS to ensure communication between the client’s web browser and our services is secure. HTTPS is the industry standard for the secure transmission of sensitive data across the web. It establishes communication between both ends of the connection and uses private and shared security keys to encrypt and decrypt the information during transport.¹ Large files sent with EZ File Drop are broken into chunks and transferred to EZ File Drop’s secure storage on Amazon S3.

‍

HTTPS uses an encryption protocol to encrypt communications. The protocol is called Transport Layer Security (TLS), although formerly it was known as Secure Sockets Layer (SSL). This protocol secures communications by using what’s known as an asymmetric public key infrastructure. This type of security system uses two different keys to encrypt communications between two parties.

While the intermediary transfer of files to Amazon S3 is necessary for the functionality of EZ File Drop, this step also provides the framework needed for several of the core features of EZ File Drop. Additionally, transferring files to Amazon S3 is much quicker than transferring to most cloud storage services directly.  While at Amazon S3, your files are stored without public access, and the process of transferring them to your cloud storage service (Google Drive, Dropbox, Box, Microsoft One Drive, or FTP server) commences. Amazon S3 encrypts all object uploads and buckets and maintains strict compliance with numerous regulatory requirements.² 

Authorization and Authentication with your cloud storage services use OAuth2 for transparency about the permissions requested and gives you complete control to revoke access from EZ File Drop should you need to in the future. These keys are encrypted, stored securely, and decrypted only when needed to upload your files to the cloud storage service.  

Using only the features you have authorized on your cloud storage service, EZ File Drop again establishes a secure connection using HTTPS and uploads the files to the folders you have selected. When this upload is complete, the temporary files at AWS are deleted. If for some reason this transfer fails (such as your cloud storage drive being full) EZ File Drop holds the temporary files in Amazon S3 and allows you to initiate a retry from the EZ File Drop Admin panel for up to three days. If the transfer process has not been completed within this three-day period, the temporary files are deleted and the retry feature will no longer be available. 

The access and security of the files to your upload destination depend on the access permissions and security settings of your cloud storage service. When properly configured, they can be incredibly secure. For instance, Google Drive data centers have all data encrypted in transit and at rest and have tools designed to detect and block threats like spam, phishing, and malware conforming to strong industry standards and practices.³ 

If you have additional questions about the security of EZ File Drop, email support@ezfiledrop.com.

References:  

1. https://www.cloudflare.com/learning/ssl/what-is-https‍
2. Amazon S3 Security Features - Amazon Web Services‍
3. How Drive protects your privacy & keeps you in control