FileRun — Self-hosted File Sync and Share

Sign in with LDAP, Active Directory, SAML, ADFS, Shibboleth, Microsoft Azure, OAuth2 or Authentik. Use the one your organization already has.
Two-factor authentication uses the TOTP standard, so any authenticator app works.
Administrators can make two-factor required, and prevent the user from turning it off.
After five failed two-factor attempts, the account is deactivated automatically.

After a failed sign-in, the next attempt is slower. The account is not locked. After ten attempts, one try is allowed every thirty minutes.
Allow an account to sign in only from certain addresses. Use a wildcard, a CIDR range, or a first and last address.
Passwords are stored using Argon2id.
When a password is changed, all other sessions are signed out.

Permissions

Seven roles, applied with one click: Viewer, Commenter, Editor, Contributor, Distributor, Content manager and Uploader. They run from view-only up to full control of the contents.
The web interface, WebDAV, desktop sync, mobile and the API all use the same permission checks. What is not allowed in the browser is not allowed anywhere else.
Each way of connecting can be turned off separately.

For new accounts, link sharing, guest sharing and file history start turned off.
Guest accounts cannot sync, cannot use the API, and cannot share files themselves. They are deleted when their last share is removed.
You can hide all other users from a user completely.

Knowing what happened

Every action is saved with the IP address and the program that made it.
Each entry keeps the name of the user who acted, even if that account is later renamed or deleted.
The history of a file is kept even after the file is deleted.

Actions that failed are saved too, together with the reason why they failed.
When somebody downloads a file through a shared link, you can see all three people: who downloaded it, who created the link, and who shared the file first.

The server itself

Files are never stored in the database. They stay normal files, on normal disks, in folders you choose.
The documentation explains how to make the server safer: keep user folders outside the web folder, and stop PHP from running where it is not needed.
There is an official Docker image. It is small, it needs few server resources, and everything inside it is already configured. It includes the latest version of each component, it is maintained closely, and FileRun runs fast on it.

Except during updates, the database user does not need permission to change or delete tables.
Updates are installed only when you start them, from the control panel. Nothing is installed automatically.
If you use an editor on your own server, documents never leave your network.

Check it against your own rules

Put FileRun on your own server with a trial license and hand it to whoever signs off on security.
Or open our live installation, where you are signed in as the administrator with no sign-up.

Request a free trial Open the live demo

Also worth reading: how FileRun uses the systems your organization already has.

Security

Signing in

Permissions

Knowing what happened

The server itself

Check it against your own rules

Product

Buying

Resources

Company