fileflippers.com

mx

aspmx.l.google.com

alt1.aspmx.l.google.com

alt2.aspmx.l.google.com

alt3.aspmx.l.google.com

alt4.aspmx.l.google.com

ns

olga.ns.cloudflare.com

yisroel.ns.cloudflare.com

caa

txt

google-site-verification=J-zJuTrpiK9lCKbyH4k7bG0Cjeil6pqmCAPoSUDUk_8

google-site-verification=zaHchIHVH72c9CRIQuCw8VpjUWTd01ePyCxn4uaI-V4

v=spf1 include:_spf.google.com ~all

dmarc

v=DMARC1; p=none; rua=mailto:dmarc@fileflippers.com;

User-agent: *
Allow: /

# Private / authenticated pages
Disallow: /dashboard
Disallow: /dashboard/
Disallow: /settings
Disallow: /settings/
Disallow: /transfer
Disallow: /transfer/
Disallow: /auth
Disallow: /auth/
Disallow: /api
Disallow: /api/
Disallow: /reset-password

# Auth pages (no value in indexing)
Disallow: /signin
Disallow: /signup

# Recipient-facing transfer pages (/share/<id>, /flip/<id>, /<uuid>,
# /<slug>/<uuid>) are deliberately NOT disallowed for search engines. Do not
# "fix" this by adding them — it would make things worse, twice over:
#
#   1. A share URL IS the capability. Anyone holding it can reach the transfer.
#      A Disallow doesn't stop a discovered URL being indexed, it only strips
#      the snippet — so the listing would publish the access token itself.
#      That's the whole leak, not a reduced one.
#   2. A blocked crawler never fetches the page, so it never sees the
#      X-Robots-Tag: noindex we set on these paths in vercel.json — disabling
#      the real protection for precisely the crawlers that would have obeyed it.
#
# Letting Googlebot and Bingbot fetch means they read the noindex and never
# list the URL in any form. Training-corpus protection is handled separately in
# the AI-crawler group below, which is blocked from fetching outright.

# AI assistants & answer engines — explicitly welcome to crawl the public
# marketing pages (the goal is citation visibility in ChatGPT / Claude /
# Perplexity / AI Overviews). Stacked user-agents share ONE rule set, so the
# private-path blocks below stay in sync with the * policy above. This only
# governs the public marketing site; it has nothing to do with the "no AI
# training on your uploaded files" product guarantee.
User-agent: GPTBot
User-agent: OAI-SearchBot
User-agent: ChatGPT-User
User-agent: ClaudeBot
User-agent: Claude-SearchBot
User-agent: PerplexityBot
User-agent: Perplexity-User
User-agent: Google-Extended
User-agent: Applebot-Extended
User-agent: CCBot
Allow: /
Disallow: /dashboard
Disallow: /settings
Disallow: /transfer
Disallow: /auth
Disallow: /api
Disallow: /reset-password
Disallow: /signin
Disallow: /signup
# Transfer pages — blocked from fetching entirely here, unlike the * group
# above. These agents don't produce search listings, so there's no URL-only
# exposure to trade against, and blocking the fetch is what keeps a customer's
# client work out of training corpora. Google-Extended is the training token
# and is in this group; Googlebot (search) is not, and correctly falls to *.
Disallow: /share/
Disallow: /flip/

Sitemap: https://fileflippers.com/sitemap.xml

# FileFlippers
> File-transfer platform for creative professionals. Send big files, and get paid before you hand over the finished work.

## What FileFlippers Does
- Send large files (up to 5 GB free, 25 GB on Pro, 50 GB on Squad) with a shareable download link. No account needed to receive.
- Get paid before delivery: send a watermarked preview, and the clean original unlocks the moment the client pays (via the creator's own Stripe account). Works on every plan: 0% platform fee on Pro/Squad, 5% on free, and free needs a purchased credit pack for the watermark the gate requires.
- Watermark images and video (text, logo, or name) before sharing.
- Convert files while sending: video, audio, images, documents, fonts, vectors, 3D, ebooks, archives (e.g. MOV to MP4, HEIC to JPG, DOCX to PDF).
- AI enhance and upscale images (free needs a purchased credit pack) and video (Pro and Squad). Boost is the only model tier live right now.
- Client review, no account required for reviewers: pinned comments on images, timecoded notes on video, drawings and replies when the sender is on Pro or Squad. On a free sender's transfer, reviewers leave a plain comment on the file instead.
- Expiring and self-destructing links, and download alert emails, on every plan. Branded download pages, password protection and transfer versioning (same link, new files) are Pro and Squad. Full download analytics and team workspaces are Squad.

## Key Pages
- [Payment-gated delivery](https://fileflippers.com/features/paid-file-delivery)
- [Watermarking](https://fileflippers.com/features/watermark)
- [File conversion (hub)](https://fileflippers.com/features/convert-files)
- [Large file transfer](https://fileflippers.com/features/large-file-transfer)
- [AI enhancement](https://fileflippers.com/features/enhance)
- [Client review](https://fileflippers.com/features/client-review)
- [Pricing](https://fileflippers.com/pricing)
- [Compare vs WeTransfer](https://fileflippers.com/compare/wetransfer)

## Scanning & Safety
- Uploads are scanned for malware on arrival (files up to 2 GB).
- Video, audio and image files over 2 GB in a recognised container format are stored with standard cloud security but not scanned for malware signatures. Anything else over 2 GB, including AIFF audio, PSD, R3D, ZIP and project bundles, is quarantined and never delivered to the recipient.
- Publicly cached images are checked against known harmful-content hash lists. Transfers are served uncached and are not covered by that check; for those we act on reports and law-enforcement notices.
- Video content is not subject to automated image screening.

## Encryption
- Encrypted in transit (TLS 1.2+) and at rest (AES-256).
- No end-to-end encryption. No zero-knowledge architecture.
- Files are scanned before being encrypted at rest.

## Data Lifecycle
- Files are automatically and permanently deleted when the transfer link expires.
- Expiry windows range from 15 minutes to 60 days depending on plan.

## AI Training
- FileFlippers does not use uploaded files to train AI models. Ever.

## Infrastructure
- File storage: Western Europe. Zero egress fees.
- Database and auth: UK (London).
- Payments: Stripe (PCI DSS Level 1).
- UK GDPR compliant.

## Contact
- [FileFlippers](https://fileflippers.com)
- [security@fileflippers.com](mailto:security@fileflippers.com)
- [support@fileflippers.com](mailto:support@fileflippers.com)

Contact: mailto:security@fileflippers.com
Expires: 2027-04-17T00:00:00.000Z
Preferred-Languages: en
Canonical: https://fileflippers.com/.well-known/security.txt
Policy: https://fileflippers.com/resources/security