Three checks before anything opens.
Over the internet, getting to a file means passing all three checks. A wrong attempt doesn't burn the connection — five tries within ten minutes are allowed before it locks and the host has to hand out a fresh key.
A key only they have
You generate a one-time connection key and share it directly with the one person who should use it. It works exactly once and expires after 5 minutes.
A password they know
The right username and password, just like signing in anywhere.
Permission for that file
Even then, the person only sees the specific files you shared with them. Everything else stays invisible.
All three checks pass
Six protections working together.
Pull-only: nothing arrives uninvited
The recipient's client always initiates the request for a specific file. There is no command path in the protocol that lets a sender push a file to a peer — a malicious or unwanted file cannot be delivered without the recipient actively requesting it.
WebRTC transport encryption
Every P2P connection is secured by WebRTC's mandatory DTLS handshake, negotiated directly between the two machines — the same transport security behind browser video calls, not a custom protocol of our own.
A one-time key instead of standing trust
Internet connections are gated by a single-use, 32-character key the host generates and shares out of band — it works exactly once and expires after 5 minutes. On the LAN, the connecting machine's MAC address is checked instead.
Rate-limited, then locked
5 failed logins within 10 minutes locks the connection — over the internet or on the LAN — until the host issues a fresh key or re-approves the device.
Trusted network ranges
Pre-authorise VPN address ranges (Tailscale, ZeroTier, RFC 1918 private ranges), across every network interface on the machine, so remote teammates connect without weakening the model.
Hashed credentials
Account passwords are stored only as scrypt hashes — never in plaintext, and never written to the access log.
An open-source, stateless relay
The relay that introduces two peers holds one in-memory table of pending pairings and nothing else — no database, no disk write. It forgets a pairing the instant its two peers connect, relays only the connection handshake — never a file or a password — and it's open source, so you can audit it or run your own instead of the default.
Every knock at the door, written down for good.
On the Enterprise tier, Privatta keeps its own private log of every attempt to reach your files: who, from which device, which file, and whether it was allowed. There is no delete button and no admin override — once an entry is written, nobody can remove or edit it, including you. Passwords never appear in it, and when a device tries its luck too many times, the connection locks until you approve it again.
Bring this to your security review.
The full protocol detail — handshake sequence, identity model, NAT traversal — is documented for procurement and IT architecture teams.