--- title: "Proving who is on the other end · Privatta" description: "Pull-only requests, transport encryption, a one-time key, a second factor, and guests who see only what you published." url: "https://royalsoftworks.com/products/privatta/security/proving-who/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security & privacy · 2 of 4 # Proving who is on the other end. Pull-only requests, transport encryption, a one-time key, a second factor, and guests who see only what you published. ## Pull-only: nothing arrives uninvited The recipient's client always initiates the request for a specific file. There is no command path in the protocol that lets a sender push a file to a peer — a malicious or unwanted file cannot be delivered without the recipient actively requesting it. ## WebRTC transport encryption Every P2P connection is secured by WebRTC's mandatory DTLS handshake, negotiated directly between the two machines — the same transport security behind browser video calls, not a custom protocol of our own. ## A one-time key instead of standing trust Internet connections are gated by a single-use, 32-character key the host generates and shares out of band — it works exactly once and expires after 5 minutes. On the LAN, the connection is HTTPS straight to the host, with a username and password and, for users you set one on, a check of the connecting machine's MAC address. ## A second factor that never travels with the key Since 1.1 the host also generates a 6-character security code. It is created on the host machine and never passes through the relay, so it is meant to go by a different route than the key — read out on a call while the key goes by chat. The host checks it before credentials and before listing a single file, which makes an intercepted key on its own worthless. ## Guests see only what you published A peer without an account on your machine can be let in deliberately: they still need both the key and the code, and once in they see exactly the files you set to Everyone. Anything narrower requires signing in as a user you created, and the panel tells you how many public files exist before you hand out a key. [Previous Four checks before anything opens.](https://royalsoftworks.com/products/privatta/security/checks/) [Next Keeping the door shut.](https://royalsoftworks.com/products/privatta/security/keeping-it-shut/) [All of Privatta security](https://royalsoftworks.com/products/privatta/security/)