Security & Privacy

What WeTransfer does with transferred files — zipping for upload/download, encryption (TLS and AES-256), when WeTransfer may review file contents, and how to give or revoke consent.

WeTransfer's good behavior policy — what users must not do, including sharing copyrighted content, sending spam/phishing, posting harmful content, impersonation, and reselling.

Overview of WeTransfer's platform security — GDPR and Dutch UAVG compliance, ISO/IEC 27001 certification, encryption in transit and at rest, and how to report a vulnerability.

How WeTransfer stores personal information — 12-month anonymization, GDPR compliance as a Dutch company, global privacy rules, and why we're not HIPAA compliant.

Privacy notice for WeTransfer surveys — what data is collected, why, retention periods, third parties involved, and how to withdraw consent.

Where WeTransfer stores your files — EU servers for users uploading from EU IP addresses, US servers otherwise.

Why WeTransfer moderates content, how automated and human moderation work together, our commitments under the Digital Services Act, and our principles around content ownership and AI.

Warning signs to check before downloading a suspicious WeTransfer transfer, our security measures, and when malware scanning is available.

What to do if your email address has been used without your knowledge to send a malicious transfer — secure your account, enable 2FA, and request WeTransfer to block your address.

How to identify phishing emails and fake communications impersonating WeTransfer — what we'll never ask for, warning signs, and how to distinguish a real notification from a fake.

How to report a transfer, file request, or Collect board for violating our Content Moderation Policy or Terms of Service — plus how to appeal blocked content.

Why someone with a Gmail address similar to yours may appear to be sending transfers from your address — how Gmail's dot rules work.

What to do if someone has shared your private photos or videos without your consent on WeTransfer — takedown process, law enforcement, and external support.

What the WeTransfer Trust Center is, what it contains, and who can access it (business use only, NDA required).

Why WeTransfer Support sometimes asks you to verify ownership of your account, what kind of information we may request, and what we'll never ask for.

When and why you may need a GDPR Data Processing Agreement (DPA) when using WeTransfer for business, and where to download it.

How to request access to or deletion of your personal data under GDPR using WeTransfer's privacy portal, and what deletion involves.

Why uploading health or medical information requires consent, how to accept or withdraw it, and the fixed 60-day expiry for these transfers.