Security & Privacy

Security-first scanning, privacy-first handling

Virus Purge is designed to help users quickly identify potentially malicious files while minimizing data retention and protecting user privacy.

Malware scanning

Automated threat detection

Uploaded files are analyzed using industry-standard malware detection technologies and continuously updated threat intelligence sources.

Scan results may identify known malicious patterns, suspicious behavior, or potentially unwanted software.

Detection systems are updated regularly to improve coverage against newly discovered threats.

Privacy & file handling

How uploads are handled

  • Files are transmitted securely using encrypted connections.
  • Uploaded content is processed only for malware analysis purposes.
  • Virus Purge does not sell uploaded files or share file contents with advertisers.
  • Virus Purge does not store the uploaded files for later purposes.
  • Limited scan-related metadata may be retained for abuse prevention, account history, and service reliability.
  • Additional details are available in our Privacy Policy .

Important limitations

No scanner is perfect

  • No malware detection service can guarantee 100% accuracy.
  • A clean result does not guarantee that a file is completely safe.
  • New, targeted, or previously unknown threats may not always be detected.
  • Scan results should be treated as informational and not as a substitute for endpoint protection or professional security practices.

Security contact

Responsible disclosure

If you believe you have identified a security issue related to Virus Purge, please contact us at [email protected] .

Infrastructure & hosting

Where your file goes

The Virus Purge web application and scanning engine run on dedicated servers in a European data centre. The application is served behind a reverse proxy that enforces TLS 1.2+ with modern cipher suites, with HTTP traffic redirected to HTTPS.

Scans are processed entirely server-side. Uploaded file contents live in memory and a short-lived temporary file inside an isolated scan worker, never on shared persistent storage. The temporary file is unlinked as soon as the scan completes, and the memory buffer is released to the operating system.

We apply security patches to the host operating system and underlying software on a continuous basis, and the antivirus signature database is refreshed automatically multiple times a day.

Application-layer protections

How the web app is hardened

  • Strict Content Security Policy restricting where scripts, styles, frames, and connections may load from.
  • HSTS with a 2-year max-age and preload, so modern browsers refuse insecure connections.
  • X-Content-Type-Options: nosniff and X-Frame-Options: DENY to prevent MIME confusion and clickjacking.
  • Referrer-Policy: strict-origin-when-cross-origin to prevent leaking sensitive URL parameters to third parties.
  • Permissions-Policy disabling camera, microphone, geolocation, and payment APIs site-wide.
  • Per-IP and per-account rate limiting on scan and authentication endpoints to mitigate abuse and brute force.
  • All authentication and session cookies are HttpOnly, Secure, and SameSite=Lax.

Account security

How accounts and API keys are protected

  • Passwords are hashed server-side with a slow, salted, modern password-hashing algorithm. Plaintext passwords are never stored.
  • Sign-in supports password authentication and OAuth (Google) via a dedicated authentication provider. We never see your Google password.
  • Premium API keys are generated with a cryptographically secure random source, scoped to a single account, and revocable at any time from the dashboard.
  • Payments are processed by Stripe. Card details never reach our servers \u2014 we only ever see a Stripe customer ID and the result of the transaction.

What metadata we retain

Strictly what is needed

For signed-in users, we retain the following metadata about each scan, so we can show you your scan history:

  • Original file name and size.
  • Scan verdict (CLEAN / INFECTED / ERROR).
  • Names of any detected threats.
  • Scan duration and timestamp.
  • Whether the file was an archive.

For unauthenticated (guest) scans, we retain only aggregate counts for abuse prevention. No per-file metadata is stored against your identity.

Last updated: 17 May 2026