Threatless

Privacy

How Threatless handles file bytes, metadata, and URL fetches.

Threatless is built to scan untrusted files without becoming a file store.

File bytes

Uploads and URL downloads are streamed to ClamAV in memory (nINSTREAM). After the verdict, the stream is closed. The product does not keep a copy of the file on disk or in the database.

What we do keep

Scan metadata is stored on your account so you can audit results:

  • filename
  • infection status and virus name
  • duration
  • timestamps

Account data includes email, name, plan, API keys, and billing identifiers. Passwords are hashed with BCrypt.

URL scanning and SSRF

URL scans fetch a remote resource on your behalf. To keep that from becoming an open proxy, Threatless:

  • Allows only http and https
  • Resolves the host and rejects loopback, link-local, site-local, and private RFC 1918 ranges
  • Blocks cloud metadata hosts (169.254.169.254, metadata.google.internal, *.internal, localhost)
  • Follows redirects only after validating the next URL the same way
  • Caps download size at 10 MB

A blocked target fails the scan with an error. It does not retry against an internal address.

Transport

The hosted app is served over HTTPS. Self-hosted deployments should terminate TLS at a reverse proxy. The API allows credentialed CORS from configured origins and exposes rate-limit headers to the browser.

GDPR posture

The hosted product is intended to process scan metadata as needed to provide the service. Files are not retained after analysis. To delete an account, email contact@trythreatless.com.

Previous

Account & sessions

Email and Google sign-in, email confirmation, and session revocation.

Next