Files are never served from a permanent public address. Each download uses a signed link generated only for a signed-in person who is allowed to see that exact file, and it expires after one hour.

• Guessing or sharing a link doesn't give anyone else access, because it stops working.
• Contacts can only open files for their own company and, for restricted files, only if they're on the access list. See Files and approvals.
• Uploads are checked against a list of safe file types. Executable files such as .exe and .bat are blocked, both in the browser and on the server.
• The maximum file size is 50 MB.