AppForShare Security and Compliance Measures

AppForShare does not hold security certifications such as SOC 2, ISO 27001 or HIPAA, and it does not publish third-party security audit or penetration test reports. What it does have is a set of concrete security and privacy measures: HTTPS everywhere, a private storage bucket, short-lived signed download links, optional passwords on builds, private projects for teams, mandatory two-factor authentication for admin staff, hashed IP addresses and fixed data retention periods.

An earlier version of this post described regular security audits and GDPR compliance claims that we cannot back up, so it has been rewritten to state only what is true. If your company needs a formal certification before sharing builds, AppForShare may not meet that requirement today.

Security measures in place

Area	What AppForShare does
Transport	HTTPS on every page, upload, install link and download
Storage	Builds stored in a private Google Cloud Storage bucket in the US (us-east4)
Downloads	Signed download links that expire quickly; the bucket is never public
Access to builds	Optional password per build (Free and above); private projects for invited testers only (Team)
Link expiry	Guest 3 days, Free 7 days, Pro and Team while subscribed
Team access	Workspace roles: Admin, Developer, Viewer
Staff access	Mandatory two-factor authentication for admin staff
Abuse	Abuse reports reviewed by staff
Payments	Handled by Stripe; AppForShare never sees full card numbers
Webhooks	Generic webhooks signed with HMAC-SHA256 so receivers can verify them

Links are never reused, so an old install link or QR code cannot start pointing at someone else's build. For a closer look at how files are handled, see how AppForShare protects your files.

Privacy and data retention

• IP addresses are stored hashed.
• Install analytics are kept for 13 months.
• UDID lookups from the UDID finder are deleted after 1 day.
• Sessions and webhook logs are kept for 30 days.
• Deleted builds can be restored for 7 days, then the file is removed for good.
• Google sign-in uses your basic profile only.
• To delete your account, email [email protected].

The service providers that process data for AppForShare are Google Cloud, Cloudflare, Stripe and SendGrid. Details are in the privacy policy.

What AppForShare does not claim

To help security reviewers, here is a direct list. AppForShare does not have or offer:

• SOC 2, ISO 27001 or HIPAA certification, or a GDPR certification.
• Published security audit or penetration test reports.
• End-to-end encryption of builds.
• Malware scanning of uploaded files.
• An uptime SLA or 24/7 support.
• Mobile device management (MDM) features.

How to use AppForShare safely for sensitive builds

• Set a password on each build and share it through a different channel than the link.
• On Team, use private projects so only invited testers can open builds, and give team members the lowest role they need.
• Use paid plans for long betas, but delete builds you no longer need.
• Keep production secrets and real customer data out of test builds.
• Store CI upload tokens as secrets in your CI system, never in your repository.
• Verify the signature on webhook requests before acting on them. See the webhooks documentation.

Questions from your security team

If you need more detail for a vendor review, contact [email protected] or use the contact page. AppForShare is run by ZenTalk LLC in Houston, Texas.

Frequently asked questions

Does AppForShare conduct security audits?

AppForShare does not publish third-party security audit or penetration test reports and does not claim to be audited. It relies on HTTPS, private storage, signed short-lived download links, optional passwords and staff two-factor authentication.

Is AppForShare SOC 2 or ISO 27001 certified?

No. AppForShare does not hold SOC 2, ISO 27001, HIPAA or GDPR certifications.

Where are uploaded builds stored?

In a private Google Cloud Storage bucket in the US, in the us-east4 region. Files are only served through signed download links that expire quickly.

How long does AppForShare keep personal data?

Install analytics are kept for 13 months, UDID lookups for 1 day, and sessions and webhook logs for 30 days. IP addresses are stored hashed.