Ensuring Data Security: How AppForShare Protects Your Files

AppForShare protects your app builds with HTTPS on every page, a private storage bucket, signed download links that expire quickly, and an optional password on each build. Files are stored on Google Cloud Storage in the US (us-east4) and are never publicly listed: a tester can only download a build through a short-lived signed link created when they open your install page.

This post explains each measure, what it protects against, and what AppForShare does not claim to do, so you can decide how to share sensitive pre-release builds.

What AppForShare stores

AppForShare is a service for sharing mobile app builds for testing. You upload an Android .apk or iOS .ipa, and testers install it over the air from an install link or QR code. The files we hold are those builds, plus the account, billing and install data needed to run the service. It is not a general file sharing service, so documents, videos and other file types are not part of it.

Security measures in place

HTTPS everywhere

All pages, uploads, install links and downloads are served over HTTPS, so builds and passwords are encrypted in transit between the device and our servers.

Private storage and signed download links

Builds are stored in a private Google Cloud Storage bucket in the us-east4 region. The bucket is not public. When a tester taps install, AppForShare creates a signed download link that is valid for a short time only. Copying that download URL and sharing it later does not give lasting access to the file.

Password protected builds

On the Free plan and above you can set a password on a build. Testers must enter it before they can see the install button. Guest uploads (no account) do not have this option.

Links that expire

Install links do not live forever. Guest links last 3 days and Free links 7 days. Pro and Team links stay live while the subscription is active. After you cancel a paid plan, links follow Free rules and stay live 7 more days. Read more in how long links stay available.

Slugs are never reused

Every build gets its own link. An old link or QR code will never start pointing at someone else's build, even after the original is deleted.

Private projects for teams

On the Team plan, a project can be private so that only invited testers can open its builds. Team workspaces also have roles (Admin, Developer, Viewer) so not everyone on the team can change or delete builds.

Staff access and abuse handling

AppForShare admin staff must use two-factor authentication. Abuse reports about shared links are reviewed by staff.

Privacy and data retention

• IP addresses are stored hashed, not in plain form.
• Install analytics are kept for 13 months.
• UDID lookups from the UDID finder are deleted after 1 day.
• Sessions and webhook logs are kept for 30 days.
• Deleted builds can be restored for 7 days, then the file is removed for good.
• Payments are handled by Stripe. AppForShare never sees full card numbers.
• Google sign-in uses your basic profile only.

Our service providers are Google Cloud, Cloudflare, Stripe and SendGrid. The full details are in the privacy policy.

What AppForShare does not claim

To be clear about the limits: AppForShare does not hold SOC 2, ISO 27001 or HIPAA certifications, does not publish penetration test reports, does not offer end-to-end encryption, and does not scan uploads for malware. If your organization requires any of these, check with your security team before uploading. For more, see our security and compliance overview.

Good practice for sharing sensitive builds

• Set a password on builds that are not ready for wide sharing, and send the password through a different channel than the link.
• Delete builds you no longer need.
• On Team, use private projects and invite only the testers who need access.
• Do not ship real API secrets or production credentials inside test builds.

Frequently asked questions

Where does AppForShare store my app files?

Builds are stored in a private Google Cloud Storage bucket in the US (us-east4 region) and are served only through short-lived signed download links.

Can I password protect a build?

Yes. Free, Pro and Team accounts can set a password on any build. Testers must enter it before they can install. Guest uploads without an account cannot use passwords.

Is AppForShare SOC 2 or ISO 27001 certified?

No. AppForShare does not hold SOC 2, ISO 27001 or HIPAA certifications and does not claim them. It relies on HTTPS, private storage, signed links, optional passwords and limited data retention.

What happens to a build after I delete it?

A deleted build can be restored for 7 days. After that the file is removed permanently.