One app. Three ways to reach someone.
On your office network
On a shared network, Privatta spots the other computers running it automatically. Transfers are instant and never touch the internet. On mobile, scan a QR code shown on the desktop app to pair instantly — no typing an address, no account.
mDNS discovery plus an active network scan. No router config, no port forwarding. QR pairing works from the Android companion app; iOS is in development.
From drag-and-drop to delivered file.
What actually happens between adding a file and it landing on the other machine.
- 01
Add the file
Drop a file into Privatta and choose who can see it: public on the LAN, a named user, or a group. Bundle related files into a virtual folder to share one policy.
- 02
Discover the other machine
On a shared network, mDNS and an active scan find other Privatta installs automatically. Over the internet, the host presses Generate Key and gets two things: a one-time connection key and a 6-character security code, meant to be sent by two different routes. There's no directory to search.
- 03
Open an encrypted channel
A lightweight signaling server introduces the two machines and relays just enough to set up a WebRTC connection, then gets out of the way. The channel itself is secured by WebRTC's own DTLS encryption, negotiated directly between the two machines.
- 04
Pass the checks
Over the internet, the connecting peer presents the one-time key and then the security code, which the host checks before anything else — before credentials, and before a single file is listed. From there they either sign in with a username and password, or continue as a guest and see only the files marked for everyone. On the LAN, it's a whitelisted MAC address plus username and password. Five wrong codes or passwords lock the connection until the host issues a fresh key and code.
- 05
Only the recipient can pull
Passing the checks gets you a file list, not a file. The host's process has no command that pushes bytes to a peer — the recipient always has to request a specific file before a single byte moves. Nothing arrives that wasn't asked for.
- 06
Transfer directly
Once requested, the file streams straight from sender to recipient over the encrypted channel, with live progress. No intermediate server holds a copy at any point.
- 07
Log it (Enterprise)
The attempt — allowed or denied, by whom, from where, over which transport, for which file — is written to a local access log, with internet sessions recorded as fully as local ones since 1.1. On the Enterprise tier that log is immutable: there is no delete or edit capability in the code, by anyone, and entries are hash-chained so an edit from outside the app is detectable. Passwords are never recorded.
See exactly what's checked at the door.
Encryption, the signaling server, and the audit trail — the full security model in one place.