Encrypted protected-file contents
Protected payloads use authenticated encryption and are stored in a private UploadLock storage area rather than being treated as ordinary public media files.
UPLOADLOCK SECURITY
Security architecture you can explain without overselling it.
UploadLock combines encrypted protected-file storage, key protection, signed licensing, verified updates, controlled rollback, recovery safeguards, and public-form abuse controls.
Built with security as a core design requirement. UploadLock has undergone extensive internal adversarial testing and controlled-pilot regression review covering encryption, key handling, private storage, access isolation, recovery, update integrity, and abuse controls. An independent third-party security audit has not yet been completed, and UploadLock is not represented as independently audited or certified at this stage.
Wrapped encryption key
The document encryption key is stored wrapped with server-held WordPress secret material rather than left as a legacy database-readable plaintext option.
Signed licensing
Commercial entitlements are cryptographically signed and bound to the licensed site and installation. The raw activation key is used for activation and is not persisted for routine refreshes.
Verified updates
Update manifests are signed, packages are hash-verified, ZIP structure is inspected, release channels are isolated, and a new build must prove boot health before confirmation.
Rollback and recovery discipline
The prior known-good plugin build is preserved during controlled updates. Existing protected data and recovery paths are designed not to be destroyed by a license or update failure.
Abuse controls
Public upload and passcode flows include minimum passcode requirements and throttling/honeypot safeguards intended to reduce automated abuse.
What UploadLock does not claim
UploadLock does not currently claim independent certification, full database encryption, malware scanning, or protection of every piece of WordPress operational metadata. Filenames, MIME types, relationships, and audit metadata may remain in the WordPress database.