Dropvi: Large File Transfer Built on the Cloudflare Edge

Project Overview

Dropvi is our own product: a large file transfer service at dropvi.com. A sender drops files into the browser, gets a link, and shares it. The free plan carries up to 50 GB per transfer with no account needed to share a link, and recipients never sign in. Paid plans add larger transfers, longer retention, PIN or password access, download limits and a branded portal on the customer’s own subdomain.

Every transfer is end-to-end encrypted, so Dropvi stores files it cannot read. It is a production service with live Stripe billing, not a demo. It is also a working example of how we build software for clients: a typed monorepo, serverless infrastructure with almost no running cost, and a security audit before anything is promoted.

The Strategic Challenge

File transfer looks simple and is not. Four problems had to be solved together.

• Size. A browser tab has to move tens of gigabytes without exhausting memory, and survive a connection that drops part-way through.
• Cost. Storage is cheap; bandwidth is not. A service that pays for every download cannot offer a generous free tier.
• Abuse. Any service that lets anonymous users upload files and send emails will be tested by spammers within days.
• Trust. Words such as “end-to-end encrypted” are easy to type on a landing page. We kept that claim off the site until the code delivered it, and then scoped it to exactly what the code does.

How We Built It

Serverless from end to end

The front end is Astro 7 with Svelte 5 islands, deployed to Cloudflare Workers. The API is a Hono application on Workers, with R2 for files, D1 (through Drizzle ORM) for metadata and Durable Objects for a live WebSocket room per transfer. The web app and API share their request and response types through a package of Zod schemas, so a contract change fails the build on both sides and not in production.

R2 does not charge for egress, which is what makes a 50 GB free tier viable. With no servers or containers, the cost of the service at idle is close to zero.

Uploads that survive real networks

Files are split into parts and sent as an R2 multipart upload. If the connection drops, only the part in flight is lost. The API checks uploaded sizes against the declared sizes exactly, which stops a free account from storing more than its plan allows.

Downloads, previews and ZIPs

Recipients can preview video, audio, PDFs and images before they download. Single files stream with HTTP Range support, so an interrupted download resumes. Whole transfers can be downloaded as a single ZIP.

Payments with limits the API enforces

Stripe Checkout and the customer portal handle subscriptions in GBP. Signed webhooks record every plan change, and the API (not only the interface) enforces each plan’s limits: transfer size, retention, and access to PINs, download limits and branded subdomains.

Audit first, then launch

Before promoting the service we ran a line-by-line security and correctness audit of the API. The fixes shipped before launch:

• rate limits on sign-in codes, transfer creation and password attempts
• a lockout on repeated PIN or password failures, with salted PBKDF2 hashing and constant-time comparison
• email delivery only for senders who have confirmed their address with a one-time code, which closed an open email relay
• passwords moved out of download URLs, so they never reach logs or browser history
• a “report this transfer” route with an admin abuse queue, where the reporter can supply the full link so a report can still be reviewed once transfers are encrypted

The same review covered the marketing. Claims the product could not prove were removed, the pricing page was rewritten to list only features that exist, and planned features are labelled as planned.

End-to-end encryption for every transfer

Ten days after launch we made end-to-end encryption mandatory for every new transfer, with no opt-out and no plan gating. We wrote and reviewed a design and threat model first, then shipped it in five phases on 27 and 28 September 2026.

• In the browser. Files are encrypted with the Web Crypto API before upload: AES-256-GCM in 1 MiB records, with keys derived through HKDF-SHA256. File names, types, the title, the message and the sender’s name are sealed too.
• The key stays out of the server’s reach. It travels in the link’s # fragment, which browsers never send to a server. When a sender sets a PIN, a key derived from the PIN is mixed in, so a leaked link alone cannot open the files.
• Nothing the recipient relies on was lost. A bundled service worker decrypts downloads, whole-transfer ZIPs (written as streaming ZIP64) and video previews as they stream, and HTTP Range still works because ranges map onto whole records. Share pages run under a strict Content Security Policy.
• The same format in the CLI. The command-line tool encrypts before upload and decrypts on download, and treats any altered size, digest or file order as tampering.

We were just as precise about the limits. Dropvi still sees encrypted sizes, file counts, recipient email addresses and IP addresses, and a web app can only be as trustworthy as the code it is served. The site and the privacy notice say so in plain words.

A command-line tool

The Dropvi CLI is published on npm as @zorinto/dropvi-cli under the MIT licence. It sends and fetches transfers from a terminal or a CI job, resumes interrupted sends and checks the integrity of every file it fetches.

Built to be found

The marketing site follows the same technical SEO standards we apply to client work: prerendered pages, a generated sitemap with honest lastmod dates, noindex headers on private transfer pages, structured data on the homepage only, six sourced comparison pages, seven use-case pages and two free tools that earn links by being useful.

Results & Impact

Dropvi went from first commit on 13 September 2026 to a deployed, audited service with live billing on 17 September 2026. End-to-end encryption, the CLI, self-serve account deletion, enforced retention and a full privacy notice followed by 29 September. After the performance work, measured on 19 September, the homepage scored 99 to 100 in Lighthouse on simulated mobile (from 69 to 74), with Largest Contentful Paint down from around 9 to 10 seconds to 1.5 to 2 seconds and page weight down from 3,443 KiB to 244 KiB.

The product is new, so we are not quoting user or revenue numbers. What this case study shows is the engineering: a complete SaaS product (uploads, downloads, accounts, billing, branding, abuse controls, observability and SEO) designed, built, audited and launched in under a week, then made end-to-end encrypted within a fortnight.

Technology

Built with Astro 7 and Svelte 5, served by Cloudflare Workers with a Hono API, storing files in R2 and metadata in D1 through Drizzle ORM, with Durable Objects for live transfer rooms, Web Crypto for end-to-end encryption, a Node.js CLI on npm, Stripe for billing, transactional email for delivery and notifications, and Sentry for error tracking.

Planning a SaaS product or a serverless build? See our SaaS development service and software development service, or start a project. Dropvi is the kind of end-to-end product we build for clients.