1. HOME
  2. HOW IT WORKS

How it works

What happens between "Send" and "Downloaded."

GCN.ONE is built around one constraint: the server must never see your files unencrypted, or any key that could unlock them. Everything below is shaped by that single rule.

The three steps you actually take
1
Verify your email
Enter an email address and solve a quick captcha. We send a verification link - no signup form and no password to choose. Clicking the link creates a temporary account that exists only for this transfer; after 3 days it and everything you sent are erased. The confirmation email includes a generated password so you can sign back in during those 3 days.
2
Encrypt in the browser
Your browser generates a random 256-bit key and encrypts every file using XSalsa20-Poly1305 via libsodium secretbox. The plaintext never leaves the browser. The server only ever sees ciphertext + nonce. When the file is shared with another account holder, that key is wrapped to the recipient using a post-quantum hybrid construction - X25519 + ML-KEM-768 → HKDF → AES-256-GCM - so a future quantum adversary that records the wrapped key today still can't unwrap it.
3
Share the link - your way
You get two share options side by side: a full link with the unlock key included after the # symbol for one-click access, or a link plus a separate key for splitting the share across two channels - send the link by email and the key over Signal, SMS, or a phone call, so no single intercepted channel is enough to open the file.
What flows where
Browser
Generates the key, encrypts the file, holds the unencrypted version.
Server
Stores the encrypted data and a one-time random value. Never sees the key.
Recipient
Opens the link; the browser decrypts using the key from the link.
Shares - what a transfer actually is

Every transfer on GCN.ONE is a share: a space holding one or more files, with its own share links, audit trail, and expiry date. The anonymous quick-send flow above creates a one-shot share that disappears the moment its expiry time is reached.

Many files, one share
A share holds as many files as you want, and every file keeps a full version history. Drop in a new version, replace a draft, append a follow-up - the share link keeps working without being reissued.
Flexible share links
Issue single-use or time-limited share links for recipients who don't have an account. Revoke any link in real time - the next download attempt fails immediately, even if the URL has already been forwarded.
Encrypted metadata
Subject, message, and every individual file name are encrypted on your device too. The server only ever sees scrambled storage chunks and random storage IDs - not the names, not the descriptions, not the contents.
Auto-expiry & audit log
Set an expiry time when you create the share. Until it expires, the owner sees every link open and every download in a per-share audit log. On expiry, the encrypted data is permanently deleted - no archive, no backup.
Proof of Delivery

We record every link open and every download, and by default we notify you the moment the recipient starts downloading the file - not just when they open the link. The encrypted bytes go straight from the storage node to the recipient and never pass through us, so what we can attest to is that the download started. You can switch the notification off per transfer if you'd rather not get one.

On request, we issue a signed delivery certificate for any file that was downloaded. It can be verified by anyone, even without a GCN.ONE account.

Infrastructure and jurisdiction

GCN.ONE runs entirely on European infrastructure under EU jurisdiction, so your data stays under EU data-protection law rather than depending on cross-border transfer arrangements.

When a transfer expires, the encrypted data is permanently deleted - no archive, no backup, no residual copy. We collect what we need to prove delivery, and nothing more.

Frequently asked questions

No. Files are encrypted on your device before upload. The encryption key is never sent to our servers. We receive and store encrypted data we cannot read.

Not for basic transfers. Just verify your email and start sending. Create an account for an inbox, a record of everything you've sent, and delivery certificates.

European infrastructure under EU jurisdiction - your data stays under EU data-protection law, not dependent on cross-border transfer arrangements.

The encrypted data is permanently deleted. No archive, no backup, no residual copy. This isn't a policy - it's how the system is built.
Ready to send something?
Verify an email and you're done. Or pick a plan if you need larger files and more transfers.
Try a transfer See pricing