One app. Three ways to reach someone.
On your office network
On a shared network, Privatta spots the other computers running it automatically. Transfers are instant and never touch the internet. On mobile, scan a QR code shown on the desktop app to pair instantly — no typing an address, no account.
mDNS discovery plus an active network scan. No router config, no port forwarding. QR pairing works from the Android companion app; iOS is in development.
From drag-and-drop to delivered file.
What actually happens between adding a file and it landing on the other machine.
- 01
Add the file
Drop a file into Privatta and choose who can see it: public on the LAN, a named user, or a group. Bundle related files into a virtual folder to share one policy.
- 02
Discover the other machine
On a shared network, mDNS and an active scan find other Privatta installs automatically. Over the internet, the host generates a one-time connection key and shares it directly with the other person — there's no directory to search.
- 03
Open an encrypted channel
A lightweight signaling server introduces the two machines and relays just enough to set up a WebRTC connection, then gets out of the way. The channel itself is secured by WebRTC's own DTLS encryption, negotiated directly between the two machines.
- 04
Pass the checks
Over the internet, the connecting peer must present the host's one-time key plus a valid username and password. On the LAN, it's a whitelisted MAC address plus username and password. Repeated failures — 5 within 10 minutes — lock the connection until the host issues a fresh key.
- 05
Only the recipient can pull
Passing the checks gets you a file list, not a file. The host's process has no command that pushes bytes to a peer — the recipient always has to request a specific file before a single byte moves. Nothing arrives that wasn't asked for.
- 06
Transfer directly
Once requested, the file streams straight from sender to recipient over the encrypted channel, with live progress. No intermediate server holds a copy at any point.
- 07
Log it (Enterprise)
The attempt — allowed or denied, by whom, from where, for which file — is written to a local access log. On the Enterprise tier that log is immutable: there is no delete or edit capability in the code, by anyone. Passwords are never recorded.
See exactly what's checked at the door.
Encryption, the signaling server, and the audit trail — the full security model in one place.