Security Architecture Whitepaper

Zero trust by design.
Protected by mathematics.

FastSTNex is engineered around the principle of zero knowledge: what we cannot read, we can never expose. Review our full cryptographic safeguards.

Raw File
AES-256-GCM Browser Encrypt
URL Hash Fragment (#key)
Browser Decryption

1. Client-Side Cryptographic Isolation

Encryption is executed entirely within your client web browser through the W3C Web Cryptography API. Every transfer package generates an ephemeral 256-bit symmetric key that never touches FastSTNex servers.

https://faststnex.com/s/{token}#key={client_aes_key}

Per RFC 3986, content after the hash (#) is strictly evaluated by the recipient's browser and is omitted from HTTP server requests.

2. Ephemeral Storage & Data Shredding

Unlike conventional cloud storage that keeps files indefinitely, FastSTNex enforces ephemeral lifespans. As soon as a transfer hits its expiration window or download threshold, automated shredding runs immediately.

  • Automatic sector overwriting on disk
  • Instant manual revocation by the sender
  • Zero residual backups of expired payloads

3. Multi-Layer Access Governance

Granting access isn't all-or-nothing. Senders can combine multiple defensive barriers to ensure only designated recipients can unlock downloads:

  • PIN Code Gates: Bcrypt-hashed passcodes required prior to stream unlock.
  • Email OTP Verification: One-time verification tokens sent to recipient inboxes.
  • Strict Rate Limiting: Automated blocking of brute-force passcode guesses.

4. Two-Factor Authentication & Account Security

For registered account holders, FastSTNex provides RFC 6238 Time-Based One-Time Password (TOTP) two-factor authentication compatible with Google Authenticator, Authy, and 1Password.

  • RFC 6238 TOTP algorithm verification
  • Cryptographically secure recovery codes
  • Strict session invalidation on password rotation

Security & Compliance FAQs

Clear answers regarding our privacy posture and data protection architecture.

Can FastSTNex engineers or administrators view my uploaded files?

No. When Zero-Knowledge encryption is active, your browser encrypts your files with AES-256-GCM before transmission. The decryption key resides exclusively in the URL hash fragment (#key=...), which web browsers never transmit to the server. Neither FastSTNex engineers nor any third party can inspect your files without the link fragment.

What cryptographic standards are used in FastSTNex?

FastSTNex implements NIST SP 800-38D AES-GCM with 256-bit keys and random 96-bit initialization vectors for payload encryption, SHA-256 for file checksum integrity, and bcrypt for PIN password hashing.

How does FastSTNex comply with GDPR and privacy regulations?

FastSTNex embodies the core GDPR principle of Privacy by Design and Default. We minimize telemetry, avoid third-party ad trackers, encrypt all payloads in transit via TLS 1.3, and enforce automated purge routines that guarantee zero residual customer data remains after expiration.

Transfer Files with Zero Knowledge