Your files. Your clouds. Clear permissions.
Understand what MergeDrive protects, what it handles and which permissions you approve.
Provider sign-in through OAuth
You authenticate with Google or Microsoft directly. MergeDrive does not request your provider password. Storage permissions are separate from account sign-in, and full-drive Google cleanup requires additional consent.
Credentials encrypted at rest
Cloud access credentials and upload session secrets are encrypted with AES-256-GCM on the server. Application API keys are stored as hashes and shown in full only when created.
Files and verified transfers
Files stay in the selected provider account. The application server handles bytes during upload, download, preview and verification. MergeDrive does not add end-to-end encryption to file contents. SHA-256 verification checks transfer integrity; it is not malware scanning.
Account and project boundaries
Login sessions use HTTP-only cookies with CSRF checks on browser writes. Developer keys have project-specific namespaces and scopes. Use HTTPS when deploying the service.
Deletion needs deliberate action
Expiry policies authorize permanent deletion at the selected time. Cleanup uses a reviewed snapshot and typed confirmation. Folder structures are retained during drive cleanup. New files outside the approved snapshot are not included.