--- title: "Four checks before anything opens · Privatta" description: "Pull-only transfers, nothing on a server, a relay that forgets, and a key and a code that travel separately." url: "https://royalsoftworks.com/products/privatta/security/checks/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security & privacy · 1 of 4 # Four checks before anything opens. Pull-only transfers, nothing on a server, a relay that forgets, and a key and a code that travel separately. Pull-only You request every file — nothing is ever pushed to you 0 Bytes of your file that ever touch a server Stateless Open-source relay forgets each pairing the instant peers connect 2-factor A 32-char connection key and a 6-char security code, sent by different routes At the door ## Four checks before anything opens. Over the internet, getting to a file means passing every check in turn — and the first two are meant to travel by different routes, so intercepting one gets you nowhere. A wrong attempt doesn't burn the connection: five tries are allowed before it locks and the host has to hand out a fresh key and code. 1 ### A key only they have You generate a one-time connection key and share it directly with the one person who should use it. It works exactly once and expires after 5 minutes. 2 ### A code that never travelled with it A 6-character security code is generated on your machine and never leaves it — send it by a different route than the key. The host checks it first, so a key on its own reaches a machine that will not answer. 3 ### A password they know — or guest access you granted Signing in with a username and password opens what you shared with that person. Without one, they connect as a guest and see only the files you marked for everyone. 4 ### Permission for that file Even then, the person only sees the specific files you shared with them. Everything else stays invisible. For your IT team - **Encryption** — Over the internet, WebRTC's built-in DTLS handshake, negotiated directly between the two machines; on the LAN, HTTPS (TLS) to the host - **Trust anchor** — Over P2P: a single-use 32-char connection key (5-minute expiry) minted by the relay, plus a 6-char security code generated on the host that never passes through it. On the LAN: credentials, plus a MAC address check for users you set one on. - **Required together** — Connection key + security code + username and scrypt-hashed password (or explicit guest access to files marked Everyone) + file permission. On the LAN: credentials (+ MAC address, where set for that user) + file permission. - **Intrusion response** — Over P2P, 5 wrong codes or passwords in 10 minutes locks the session until the host generates a fresh key and code. On the LAN, 20 failed attempts from one address in 15 minutes are refused until the window passes All four checks pass [Previous Security: all 4 pages](https://royalsoftworks.com/products/privatta/security/) [Next Proving who is on the other end.](https://royalsoftworks.com/products/privatta/security/proving-who/) [All of Privatta security](https://royalsoftworks.com/products/privatta/security/)