Skip to content
VIROX
Request access
Data security

Your files stay yours — and provably so.

Every file is encrypted before it lands, every access is recorded, and every policy is enforced server-side rather than trusted to the client. This page is the whole picture: what we encrypt, who can reach it, where it lives, and what you can prove afterwards.

Talk to security Read the API docs
SOC 2 Type II ISO 27001 GDPR
Encryption
256 bit
AES-256 on every object at rest, per-file keys
Transport
1.3 TLS
TLS 1.3 only — earlier versions are refused
Retention
12 mo
Audit records kept and exportable as CSV
Durability
11 9s
Object durability across the storage tier
How it is protected

Four layers, none of which trust the browser.

Layer 01

Encrypted before it lands

Objects are encrypted server-side with AES-256 and a per-file data key, which is itself wrapped by a workspace key. Rotating the workspace key re-wraps every data key without rewriting a single object.

AES-256-GCM at rest, TLS 1.3 in transit
Per-file data keys, wrapped by a workspace key
Key rotation without downtime or re-upload
Layer 02

Identity before access

Every request resolves to a person or an application, never to a shared secret in a config file. SAML single sign-on hands you the directory as the source of truth, and API keys carry scopes rather than blanket access.

SAML SSO with Okta, Entra or any SAML 2.0 IdP
Enforced second factor per workspace
Scoped API keys, revocable individually
Layer 03

Policy on the server

Link expiry, password requirements, download blocking and IP allow lists are evaluated on every request — including desktop sync and API calls. A client that ignores the rules simply gets a 403.

Link lifetime and password caps set workspace-wide
Downloads blockable per file, per link, per role
IP allow lists apply to API and desktop alike
Layer 04

A record of everything

Opens, downloads, shares, permission changes and deletions are written to an append-only trail with the actor, the device and the address attached. Administrators read it as sentences; auditors export it as CSV.

Append-only — no edit path, for anyone
Device and IP recorded where available
12 months retained, exportable on demand
Admin controls

Everything an administrator can actually enforce.

These are settings, not recommendations. Each one is checked on the server for every request, including API calls and desktop sync.

Sessions and devices
See every signed-in device and end any of them instantly.
SSO and 2FA
SAML with Okta or Entra, enforced second factor per workspace.
Link policy
Cap link lifetime, require passwords, block downloads by default.
IP allow lists
Restrict a workspace to your office and VPN ranges.
Roles and groups
Owner, Admin, Member and Guest, assigned by group not by hand.
Download rules
Allow viewing without allowing a copy to leave the workspace.
Session controls
Idle timeout and maximum session length, set per workspace.
Retention and trash
Hold deleted files for a fixed window before they are purged.
Audit export
Twelve months of events as CSV, whenever legal asks for it.
Where data lives

You pick the region. It does not move.

A workspace is pinned to one region at creation. Objects, versions, thumbnails and audit records all stay inside it — there is no cross-region replication unless you ask for it in writing.

eu-central-1 Frankfurt, Germany Available
eu-west-2 London, United Kingdom Available
me-south-1 Amman, Jordan Available
us-east-1 Virginia, United States Available
GET /v1/workspace/residency 
GET /v1/workspace/residency  -H "Authorization: Bearer vx_live_..."200 OK{  "region": "eu-central-1",  "pinned_at": "2026-01-14T09:22:04Z",  "replication": "none",  "audit_retention_days": 365}
Proof, not promises

What you can hand an auditor.

SOC 2 Type II report
The full report under NDA, plus the bridge letter for the current period.
Completed questionnaires
CAIQ and SIG Lite already filled in, so your team is not starting from a blank form.
Your own audit export
Twelve months of events for your workspace as CSV — the same data our support sees, no more.
Incident commitments
Notification targets and escalation paths written into the agreement, not a status page promise.

Send us your security questionnaire.

We answer the whole thing, in writing, before you sign anything. Most come back the same week.

Talk to security Read the docs
Fine print
Encryption at rest is AES-256-GCM with per-file data keys wrapped by a workspace key. Key material is held in a managed KMS and is never written to application logs.
Object storage is provided by Backblaze B2 in the region attached to your workspace; Virox operates the metadata, index, sharing and audit layers, and holds the encryption keys separately from the storage tier.
Durability and availability figures describe the storage tier as published by that provider and are not a contractual guarantee outside your agreement.
SOC 2 Type II and ISO 27001 evidence is available under NDA. GDPR covers our role as processor; the data processing addendum forms part of the agreement.
Audit records are retained for 12 months by default. Longer retention, additional regions and cross-region replication are available on request and are priced separately.