Trust center
A single place for the operational details people check before trusting a file-transfer product with sensitive documents.
ZipPigeon protects file chunks in the browser with XChaCha20-Poly1305 before upload. Migrated v3 account recipients can use X-Wing HPKE combining X25519 with ML-KEM-768, while v3 records use Ed25519 + ML-DSA-65 dual signatures.
ZipPigeon still processes operational metadata so delivery, abuse prevention, audit events, and reliability work. The privacy and terms pages describe what is processed, what should stay out of reach, and what users are responsible for.
Security researchers can report issues to security@zippigeon.com with affected routes, reproduction steps, impact, and synthetic evidence where possible. ZipPigeon also publishes a machine-readable security.txt file under /.well-known/security.txt.
Not publicly. ZipPigeon should not be described as SOC 2, HIPAA, ISO 27001, or independently audited until those assessments are completed and published for the deployed service.
Send reports to security@zippigeon.com and include affected routes, steps to reproduce, impact, and whether synthetic test data was used.
Use ZipPigeon when a file needs to reach the right person without becoming another attachment or shared folder to clean up later.
Open signed-in sender