Turvio
Security
Draft of 15 October 2026.
Encryption
Each delivery has its own AES-256-GCM key. Content, file names and recipient contact details are encrypted. When the delivery is deleted, the key is destroyed with it, so copies of the ciphertext become unreadable.
EU hosting
Turvio runs in our own data centre in the EU.
One-time deletion
After the allowed number of opens, or when the delivery expires or is revoked, the content and its key are deleted.
Responsible disclosure
If you find a vulnerability, write to security@turvio.eu and give us a reasonable time to fix it before you publish the details. Do not access data that is not yours, and do not disrupt the service. The same contact is published at /.well-known/security.txt.