--- title: "From dragging it in to it landing there · Privatta" description: "What happens in the seconds between you adding a file and them opening it." url: "https://royalsoftworks.com/products/privatta/how-it-works/step-by-step/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- How it works · 2 of 2 # From dragging it in to it landing there. What happens in the seconds between you adding a file and them opening it. Under the hood ## From dragging it in to it landing there. What actually happens in the seconds between you adding a file and them opening it. 1. 01 ### Add the file Drop a file into Privatta and choose who can see it: public on the LAN, a named user, or a group. Bundle related files into a virtual folder and apply one set of permissions to all of them at once. 2. 02 ### Discover the other machine On a shared network, a scan of the local network finds other Privatta installs automatically. Over the internet, the host presses Generate Key and gets two things: a one-time connection key and a 6-character security code, meant to be sent by two different routes. There's no directory to search. 3. 03 ### Open an encrypted channel A lightweight signaling server introduces the two machines and relays just enough to set up a WebRTC connection, then gets out of the way. The channel itself is secured by WebRTC's own DTLS encryption, negotiated directly between the two machines. 4. 04 ### Pass the checks Over the internet, the connecting peer presents the one-time key and then the security code, which the host checks before anything else — before credentials, and before a single file is listed. From there they either sign in with a username and password, or continue as a guest and see only the files marked for everyone. On the LAN, it's a username and password, plus a MAC address check for users you set one on. Over the internet, five wrong codes or passwords in ten minutes lock the session until the host issues a fresh key and code; on the LAN, twenty failures from one address in fifteen minutes are refused until the window passes. 5. 05 ### Only the recipient can pull Passing the checks gets you a file list, not a file. The host's process has no command that pushes bytes to a peer — the recipient always has to request a specific file before a single byte moves. Nothing arrives that wasn't asked for. 6. 06 ### Transfer directly Once requested, the file streams straight from sender to recipient over the encrypted channel, with live progress. No intermediate server holds a copy at any point. 7. 07 ### Log it (Enterprise) The attempt — allowed or denied, by whom, from where, over which transport, for which file — is written to a local access log, with internet sessions recorded as fully as local ones since 1.1. On the Enterprise tier that log is immutable: there is no delete or edit capability in the code, by anyone, and entries are hash-chained so an edit from outside the app is detectable. Passwords are never recorded. ## See exactly what's checked at the door. Encryption, the signaling server, and the audit trail — the full security model in one place. [Security](https://royalsoftworks.com/products/privatta/security/) [Read the whitepaper](https://royalsoftworks.com/products/privatta/whitepaper/) Free to download, no account · Pro €19 a month · Windows · Android · [Download free →](https://royalsoftworks.com/download/#privatta) [Previous One app. Three ways to reach someone.](https://royalsoftworks.com/products/privatta/how-it-works/three-ways/) [All of Privatta how it works](https://royalsoftworks.com/products/privatta/how-it-works/)