File Safety on USB Club

How we protect you from malicious files. Last reviewed 2026-06-23.

USB Club is built around sharing real files between real people. The natural question that follows is: if someone shares a file, can it harm me? This document explains, in plain terms, the protections that stand between a file someone uploads and the moment it reaches you.

The short answer: every file is virus-scanned before it can become part of USB Club, infected files are stopped at the door and never appear, files live in private storage that is never publicly downloadable, and access is authorized and time-limited at every step. No single control carries the whole weight. They're layered, so a failure in one is caught by another.

The short version

• Infected files are rejected at upload. They never enter the system, so there is nothing to encounter and nothing to click.
• Only scanned, clean files surface in feeds, on profiles, or anywhere in the network.
• Files are never publicly downloadable. Access happens through cryptographically signed links that work for one file and expire quickly.
• Access is authorized. Apart from public files, seeing or preserving a file requires a direct relationship to it.
• Preserving a file requires your own registered hardware, a physical USB drive, which raises the bar far above an anonymous click.

The journey of a shared file

The clearest way to see the protections is to follow a file from the person who shares it to you.

flowchart TD
    A([Someone shares a file]) --> B[Uploaded to private cloud storage]
    B --> C{Antivirus scan}
    C -->|"Infected, unscannable,<br/>or scan times out"| D[/Rejected at upload, <br/>never added to USB Club/]
    C -->|Clean| E[Stored privately &<br/>recorded as clean]
    E --> F[Only clean files appear in<br/>feeds, profiles & the network]
    F --> G([You request the file])
    G --> H{Are you authorized?<br/>visibility · ownership · relationship}
    H -->|No| I[/Request denied/]
    H -->|Yes| J[Time-limited signed link<br/>to the private file]
    J --> K([Opens, or preserves to your<br/>registered USB drive])

1. Upload: when someone shares a file, it is placed into private cloud storage. At this point it is not visible to anyone and cannot be reached.
2. Scan: the file is scanned by a managed antivirus service. This is the gate that matters most.
3. Reject or admit: if the file is infected, can't be scanned, or the scan doesn't finish in time, it is rejected, and no record of it is ever created. Only a file that comes back clean is recorded and admitted.
4. Surface: from there, the file can appear in the network, but everything you browse is built exclusively from files that passed scanning.
5. Request: when you open or preserve a file, USB Club checks that you're authorized, then mints a signed, short-lived link to fetch it from private storage.

The layers of defense

1. Antivirus at the door

When a file is shared, it is scanned by a managed antivirus service built on ClamAV, the widely used open-source engine, before it becomes part of USB Club. The service's virus definitions are kept continuously up to date by the provider, so each file is checked against current threat signatures at the time it is uploaded. The check is fail-closed: a file that is found infected, that cannot be scanned, or whose scan does not complete is rejected outright, and no record of it is created. Because the rejection happens before the file exists in the system, there is no infected file to surface, list, or click later.

2. Only clean files surface

A file appears in the network, in daily feeds, on a profile, or in search only after it has passed scanning. Every list you can browse is assembled exclusively from files marked clean. Anything unverified or rejected is simply absent. It is never shown as an option.

3. Private storage and signed, expiring links

Files are kept in private cloud storage that is never publicly readable. There is no public address you (or anyone) can paste into a browser to grab a file. When you are authorized to open or preserve a file, USB Club generates a cryptographically signed link that is valid only for that specific file and only for a limited time. The link cannot be forged, and it expires.

4. Authorization: who can see and preserve a file

The person who shares a file controls its visibility. Beyond files that are deliberately made public, access requires a direct relationship to the file: you own it, you follow the person who shared it, you took part in the same daily exchange, or you have already preserved it. Every request is checked against these rules before any link is issued.

5. The hardware moat

USB Club's guiding principle is "on the internet you can look; on the network you can have." Looking at a public file requires nothing. But preserving a file to your USB drive requires a registered, active piece of hardware: a physical device tied to your account. Preservation is anchored to that device, which puts a meaningful, physical barrier in front of bulk or anonymous collection.

6. Account and abuse controls

Accounts authenticate with signed, verifiable session tokens. If an account is blocked or its access is revoked, it loses access immediately on its next request, with no lingering window. Sensitive actions such as signing in, pairing a device, and changing account details are rate-limited to resist brute-force and automated abuse.

What this means for you

• A file you come across on USB Club has been virus-scanned before it ever reached you.
• Infected files are stopped at upload and never appear in the system.
• Files are not publicly downloadable; access is authorized and the links that deliver files are short-lived.
• Preserving files is tied to your own registered hardware, not an anonymous click.

Continuous improvement

Security is not a finished state. We treat it as ongoing work and keep hardening these layers over time. If you believe you've found a security issue, please contact us directly and privately at support@usb.club so we can address it quickly and responsibly.