PsiDrivePRIVATE BY DESIGN
HOW PSIDRIVE WORKS

Encrypted before it leaves your browser.

PsiDrive separates your encrypted file from its decryption key. The browser encrypts and decrypts; Cloudflare infrastructure stores and transports ciphertext.

Network & security flow

SENDER BROWSER 1. Encrypt locally AES-256-GCM Key remains in browser CLOUDFLARE EDGE 2. API & abuse controls Workers + Turnstile Quota, rate & cost controls ENCRYPTED STORAGE 3. Store ciphertext R2 object storage D1 metadata only 4. Stream ciphertext Chunked direct-to-disk No plaintext stored server-side RECIPIENT BROWSER 5. Decrypt locally Key read from URL fragment Plaintext written to recipient disk Share link carries token + key after #

What the server sees

PsiDrive's backend receives encrypted file chunks, encrypted filename data, transfer metadata, quota information and security events. It does not need the AES file key to store or deliver the encrypted object.

What the recipient gets

The recipient opens the share link, authorizes the transfer, receives encrypted chunks and decrypts them in the browser. Chrome and Edge stream directly to the chosen file; modern Safari and Firefox use protected browser storage before handing the completed file to the browser download manager.

Lifecycle

UploadBrowser encrypts → Worker enforces limits → R2 stores ciphertext.
ShareThe share URL contains a transfer token plus the AES key in the URL fragment.
DownloadWorker authorizes → encrypted chunks stream → browser decrypts locally.
CleanupTransfers expire after 24 hours; abandoned multipart sessions are cleaned automatically.
PsiDrive is designed so the decryption key is not stored alongside the encrypted file. Password protection and delete-after-first-download add extra controls, but no online service can promise absolute security.