Security

Payaion is designed with security and privacy in mind. Here's how we protect your files and data.

How links are protected

• Unique IDs — Each upload gets a randomly generated ID that's hard to guess
• Automatic expiration — Every upload is deleted when its retention window ends. Guest uploads last a day; accounts keep files longer (see Limits & Quotas)
• Optional password — Lock a free transfer with a password (4+ characters). It is stored only as a bcrypt hash, never in plaintext, and the file cannot be downloaded without it
• Manual deletion — With a dashboard account, you can delete uploads immediately
• Not discoverable — Uploads are reachable only via their direct link. Nothing appears on the marketplace unless you list it there yourself
• Decentralized storage — Files stored on Walrus network, not a single server

How API keys are protected

• Shown once — Keys are displayed only during creation; we can't recover them later
• Stored securely — Keys are hashed before storage; plaintext never saved
• Tied to your wallet — Each key is linked to your authenticated wallet address
• Revocable — Disable keys instantly from the dashboard
• Rate limited — Automatic throttling prevents abuse

Best practices

• Don't share links publicly — Anyone with the link can download the file
• Keep API keys secret — Never commit them to git or expose them in client‐side code
• Use environment variables — Store keys in .env files (never commit these)
• Rotate compromised keys — If a key is exposed, revoke it and create a new one
• Delete sensitive uploads — Remove files from the dashboard when you're done

Wallet authentication

Signing in means signing a message, not sending a transaction: it proves you own the address, costs no gas, and never exposes your private keys. Payaion stores no passwords and holds no custody of your wallet. The mechanics are in Wallets & sign-in.