FileSender – send large files securely

FileSender can be used by researchers, students, lecturers, and administrative staff at research and education organisations.

Organisations that want to use FileSender must be connected to the research network, with Sikt as internet service provider.

To send files, users must login with Feide, and therefore the organization must be a Feide host organisation.

The recipient can be anyone. You can also invite people to send you files using a guest user.

FileSender is easy to use for sending large files.

This is how you send files via FileSender:

1. Log in at filesender.sikt.no with your Feide account.
2. Add the email addresses of the recipients, a subject, and a message. Recipients don't need to have a Feide account.
3. Upload the files, and optionally set an expiration date (this is optional, maximum 21 days).
4. Accept the terms of service and click "Send".

The system stores the files and sends a message to the recipient with a link to the files. A copy of the message is sent to you. The recipient clicks on the link to download the files. Once this is done, a confirmation is sent to you.

All transfers in FileSender go over an encrypted connection (TLS/HTTPS), in the same way as online banking or other secure web traffic. This applies no matter what you send, and requires no action on your part.

In addition, you can choose end-to-end encryption for extra sensitive content:

• The files are encrypted directly in your browser (client-side), with AES-256, before they are uploaded.
• Sikt's servers never see the password or the unencrypted content of the files – only you and the recipient can unlock them.
• The recipient needs a separate key/password to decrypt the files. You must send this to the recipient through a different, secure channel (e.g. SMS, phone, or another service). Never send it in the same email as the link.
• Note: Because of how the encryption works in the browser, the maximum file size is reduced to 700 MB for end-to-end encrypted transfers (compared to 2 TB for regular, transport-encrypted transfers).

Use end-to-end encryption when the content is particularly sensitive, for example personal data, research data subject to a duty of confidentiality, or other information that should not be readable by anyone other than the recipient.

Good advice for keeping outsiders from accessing your files:

• Request a download link instead of sending the link by email. (This only applies to files you send.)
• Transfer the download link to the recipient in a secure manner. Check with your own IT department how this should be done at your institution.
• Consider turning on end-to-end encryption for extra sensitive content.
• Limit the number of downloads.
• Have a short lifetime on the transfer.
• When you ask for files, an email is always sent to the recipient you're requesting a file from. The risk here is that some outsiders get hold of the link and send you a fake file. Ensure that it is the correct sender.
• Request a log of all events for the transfer. Check the log.

The service in its entirety is produced within the Norwegian higher education sector, and Norwegian law applies.

Sikt is the service provider, and USIT at the University of Oslo is responsible for the technical service delivery. Data is stored temporarily at USIT.