XTRANSFER
Access

XTND Dynamics · Enterprise file transfer

Send the file. Keep the control.

XTRANSFER moves large files between organisations on one link — with a password, an expiry date and a download cap you set before it leaves your hands. It runs on Cloudflare's edge network and stores every byte in your own Dropbox.

Request access See how it works
Password per transferExpires on your scheduleStored in your Dropbox

How it works

Three steps, one link.

A transfer is a container with a lifetime. You create it, you fill it, you share one address — and the rules you set travel with it.

  1. 01

    Create the transfer

    Give it a title and set its terms up front: a password, a number of days before it expires, a maximum number of downloads. Each transfer gets its own GUID, so the address is unguessable rather than sequential.

  2. 02

    Add the files

    Upload through the API or drop them into a watched Dropbox folder. Each file is registered in the transfer with its size, type and checksum, and stored under the transfer's own folder rather than loose in a bucket.

  3. 03

    Share the address

    One link, one password, sent however you like. Recipients need no account. Every download is counted, and when the cap or the expiry date is reached the link stops working — without you having to remember it.

Controls

The rules leave with the file.

Once a file is attached to an email it is gone — no expiry, no recall, no idea who opened it. A transfer is the opposite: the conditions are part of the object, and they are enforced on every request.

Password on the transfer

Set a password at creation and the link alone is not enough. It is never stored in readable form — only a PBKDF2 hash with a salt unique to that transfer.

An expiry date, not a promise

Choose the number of days. After that the transfer stops serving files, whether or not anyone remembers it existed.

A ceiling on downloads

Cap a transfer at a fixed number of downloads. The count is kept server-side and checked before every file is served.

Revocation that reaches the storage

Deleting a transfer removes its files from Dropbox as well as its record. Revoking access does not leave the bytes sitting somewhere.

A record of what happened

Every transfer carries its creation time, its owner, its current download count and its status. What was sent, by whom and how often it was taken is a query, not a guess.

No account for the recipient

The person receiving the file does not sign up, install anything or accept terms. They open a link and enter a password.

Security

Built on primitives, not promises.

Every security property below is a specific mechanism you can name, check and audit — not a badge in a footer.

PBKDF2 · SHA-256 · per-record salt

PBKDF2 with SHA-256

Account and transfer passwords are hashed with WebCrypto PBKDF2-SHA256 under a salt generated per record. A stolen database yields no passwords.

JWT · Authorization: Bearer

JWT bearer authentication

Authenticated API calls carry a signed JWT. Tokens are verified at the edge before a request reaches any data.

RFC 4122 · UUID v4

Unguessable identifiers

Users, transfers and files are addressed by RFC 4122 v4 UUIDs. There is no sequence to walk and no neighbouring transfer to stumble into.

Worker-proxied download stream

Storage that is never public

Downloads stream through the Worker, which checks the password, the expiry and the download cap first. The underlying Dropbox path is never exposed to the recipient.

HTTPS · HSTS max-age=31536000

In transit, always

Every request is served over HTTPS on Cloudflare's network, with HSTS enforced. There is no plaintext path to the service.

Dropbox API v2 · OAuth2 refresh

Storage you already own

Files live in your organisation's own Dropbox account, under your existing retention, backup and compliance regime — not in a vendor's silo you cannot inspect.

The platform

The edge in front, your Dropbox behind.

XTRANSFER is deliberately thin. It holds the rules and enforces them; it does not become another place your data lives and another vendor you have to trust.

  1. Request
  2. Worker · authorise
  3. D1 · rules
  4. Dropbox · bytes

Cloudflare Workers

The whole service is a Worker running at the edge — the request is authorised close to the person making it, not after a round trip to one region.

Cloudflare D1

Transfers, files, owners, expiry dates and download counts live in D1, SQLite at the edge. Metadata only — never the file bytes.

Dropbox API v2

Binary storage is your own Dropbox, reached with OAuth2 refresh tokens. Your files stay somewhere your organisation already administers.

Because storage is yours, XTRANSFER is not a place your data goes to be held hostage. Point it at a different Dropbox and the service follows.

Dropbox-native

Drop a file in a folder. Get a link back.

The fastest way to send something is not to open a web app at all. XTRANSFER watches an inbox folder in your Dropbox and does the rest.

  1. Drop a file into the watched inbox folder.
  2. A webhook fires. XTRANSFER creates the transfer, generates a password and files the document under its own GUID folder.
  3. A companion note appears alongside it with the link and the password, ready to paste into an email.

It works in the other direction too: delete a file or folder in Dropbox and the transfer is unregistered, so the two never drift apart.

Developers

A REST API, not a portal you automate against.

Everything the service does is an endpoint. Create transfers from a build pipeline, expire them from a cron job, or wire delivery into a system that already exists.

  • Token authentication with JWT bearer tokens
  • Create, list, update, delete transfers
  • Upload files as multipart or raw binary
  • Password supplied by header or query parameter
  • Dropbox webhooks for inbox and deletion sync
Create a transfer 
curl -X POST https://transfer.xgi.io/api/v1/transfers \
  -H "Authorization: Bearer $XTRANSFER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Q3 Financial Reports",
    "password": "…",
    "expires_in_days": 7,
    "max_downloads": 10
  }'

Get started

Put it to work on a real transfer.

XTRANSFER is operated by XTND Dynamics. Tell us what you need to move and how your organisation stores it, and we will set you up.

Email us

transfer@xgi.io

  • Runs on infrastructure you can name
  • Stores files in a Dropbox you already control
  • Every control enforced server-side, on every request