How Foldr handles authentication, encryption, hosting and audit. No marketing-speak, no hand-waving about “enterprise-grade” anything. If your procurement team needs more, we’ll work through your questionnaire.
SSO via SAML 2.0, Microsoft Entra ID, ADFS and Google Workspace on Foldr Cloud and on the appliance. On the appliance you can also use Active Directory, LDAP and Kerberos. Local accounts supported where you need them. Password policies, expiry and history all configurable.
TOTP authenticator apps, Duo push, and FIDO2/WebAuthn passkeys. Per-device approval for sensitive shares. Sudo re-prompt on admin actions. Self-service password reset via verified email or SMS, optional.
Every connection between users, Foldr, and your storage backends is encrypted in transit (TLS 1.2+). On Foldr Cloud, traffic between Foldr and customers terminates at the edge with TLS; cluster-internal traffic runs on the private network with Kubernetes NetworkPolicy segmentation. On appliance deployments, run Foldr behind your own VLAN or reverse proxy.
Foldr connects to SMB, S3, Azure, OneDrive and the rest in place; the original files never move into our database, and by default no file content lives on Foldr’s side. Search, previews and OCR are opt-in per share or tenant; when they’re on, the derived output (extracted text, rendered thumbnails, OCR JSON) is held server-side, encrypted at rest by the underlying service on Foldr Cloud, or on infrastructure you control on an appliance. The Trust Centre lists it explicitly.
Foldr Cloud runs on UK and EU infrastructure for compute and customer data. A small number of operational services (telemetry, default AI inference, support tooling) sit outside the UK/EU; the Trust Centre has the full residency table.
Linux appliance you install in your own datacentre, hypervisor or cloud account. Air-gapped installs supported. Same Foldr Next UI as Foldr Cloud, no internet dependency to operate.
Uploads, downloads, edits, moves, deletes, shares, link creation and permission changes are recorded against the person who did them. Retained per your policy. Downloadable as CSV from admin Settings.
Foldr shows version history from the storage backend where it has one, and keeps its own for Foldr Storage and for documents edited in Bureau.
Per-user access tokens with explicit scopes and expiry. Programmatic access is attributable to the issuing user; the small number of platform-level system actions (e.g. background crawls) are logged separately. Outside AI assistants connect through Connected Apps: each gets scoped, expiring access under the signed-in person’s own permissions, anything it changes needs a policy an administrator agrees, nothing destructive is offered, and the person is emailed when an app connects. It’s off until an administrator switches it on.
Limit who can open a share, or sign in at all, to the addresses you name: an IP allow-list on any share permission, for a person or a group, and on the permission to use Foldr. Trusted networks can also skip a two-factor prompt.
Your files stay in your storage; you control retention, residency, and rights handling. Foldr is Cyber Essentials certified, and has been independently penetration tested. We’re happy to work through your security questionnaire with you. Get in touch and we’ll send you what you need.
Try it free for 30 days, no credit card. Or get in touch about self-hosting.
