Security and control
+Security first
+We are deeply committed to protect the safety of the data of our customers. Because: +
-
+
- our development follows industry best practices around security +
- we implement a wide variety of security features and hardening +
- we offer the highest security bug bounties in the open source industry +
; ?>/assets/img/features/TOTP.png)
+ Share on your terms
-With Nextcloud, system administrators can control and direct the flow of data between users on a server. Rule based file tagging and responding to these tags as well as other triggers like physical location, user group, file properties and request type enables administrators to specifically deny access to, convert, delete or retain data following business or legal requirements.
-Features including our monitoring app, 2-factor authentication, brute force protection and our Eur 5000 security bug bounty program give you the highest level of security and protection against privacy breaches.
+Workflow management
+With Nextcloud, system administrators can control and direct the flow of data between users on or between servers. Rule based file tagging and responding to these tags as well as other triggers like physical location, user group, file properties and request type enables administrators to specifically deny access to, convert, delete or retain data following business or legal requirements.
Nextcloud puts you in control of your data and keeps it safe.
Security and authentication
+Nextcloud is designed to protect user data
+ through multiple layers of protection.
+ Security process
+Security bugs are like technical debt: fixing them later is expensive. Our strategy is thus to prevent them from happening through a rigorous focus on security through the entire life cycle of our product.
+Click each step in the process to learn more
+-
+
; ?>/assets/img/security/training.svg)
+ ; ?>/assets/img/security/requirements.svg)
+ ; ?>/assets/img/security/implementation.svg)
+ ; ?>/assets/img/security/verification.svg)
+ ; ?>/assets/img/security/response.svg)
+
Security training
+-
+
- We provide detailed documentation about common web security vulnerabilities +
- We organize internal and public security trainings +
- Developers are asked to fix security issues they caused themselves +
; ?>/assets/img/security/training2.png)
+ Requirements
+-
+
- Privacy and security risks are analyzed and requirements are established +
- We employ advanced threat modelling / attack surface analysis +
- Designs are reviewed for security implications +
; ?>/assets/img/security/design2.png)
+ Implementation
+-
+
- Unsafe functions are forbidden (e.g. unserialize, non-prepared statements and unsafe comparisons) +
- Our internal functions are designed to provide secure defaults for developers +
- We employ a strict mandatory code review process with 2 reviewers besides the original developer +
; ?>/assets/img/security/reviewprocess.png)
+ Verification
+-
+
- We regularly run static and dynamic security scans +
- We follow industry best practices in disclosing security issues fixed in a release: 2 weeks after the release is made available. +
- Advisories with CVE identifiers are published +
; ?>/assets/img/security/scan.png)
+ Response
+-
+
- We run a successful bug bounty program with high payouts, up to EUR 5000 +
- Statistics show a massive decrease of valid external security reports +
; ?>/assets/img/security/hackerone.png)
+ Security bug bounties
+
+ We have partnered with the HackerOne platform because of its extraordinary popularity among IT security professionals. More than 3,000 hackers have reported over 24,000 bugs via the platform. Running a program on HackerOne allows us to quickly leverage the collective knowledge of a huge amount of these security experts.
+Anyone reporting a security vulnerability in Nextcloud can earn up to USD 5000, making ours some of the highest security bug bounties in the open source industry. For more details, see our announcement.
+Find an example of RhinoSecurityLabs blogging about a security issue dealt with here.
+; ?>/assets/img/security/HackerOne.png)
+ Authentication capabilities
+The Nextcloud authentication system supports pluggable authentication including two-factor authentication and device specific passwords, complete with a list of connected browsers and devices on the users’ personal page.
+Active sessions can be invalidated through the list, by removing the user in the admin settings or by changing passwords. Admins can enable or disable two-factor authentication for users on the command line.
+Nextcloud supports SAML 2.0 (“Shibboleth”) authentication and has extensive LDAP directory integration.
+
+ Brute force protection
+Brute Force Protection logs invalid login attempts and slows down multiple attempts from a single IP address (or IPv6 range). This feature is enabled by default and protects against an attacker who tries to guess a password from one or more users.
+You can find more information on hardening your Nextcloud installation in our extensive hardening guide +
Security hardening
+Nextcloud employs a wide variety of extra security hardening capabilities, including:
+-
+
- Content Security Policy
+
-
+
- First implementation in 2013 +
- Dropbox implemented it in 2015 +
+ - Same-Site Cookies
+
-
+
- Cookies will only be sent if request originates from the same origin (preventing CSRF vulnerabilities) +
- Currently only supported in Chrome and Opera, Mozilla is working on Firefox support. +
+
; ?>/assets/img/features/encryption-home.png)
+ Encryption
+Nextcloud employs industry-standard TLS to encrypt data in transfer. On the server, admins can enable server side encryption for extra protection.
+Server side encryption protects files on the Nextcloud server or external storage from being seen by third parties. As files are encrypted and decrypted on the Nextcloud server, this does not protect from malicious system administrators or a compromised server but it provides an additional layer of protection for cases when server hardware gets stolen.
+Encryption is particularly useful when used in combination with external storage as the third party storage system will never see unencrypted files.
+Nextcloud supports pluggable encryption key handling. If you have an external key server, this can be made to work with Nextcloud.
+Administrators can set a system wide recovery key for encrypted files. This ensures that, even when users lose their password, files can always be decrypted. Encrypted files can be shared but after changing encryption settings, shares will have to be re-shared.
+Learn how to use server side encryption in our documentation
+; ?>/assets/img/features/encryption-recovery.png)
+ Screenshots
+
+ ; ?>/assets/img/features/TOTP-login.png)
+ ; ?>/assets/img/features/encryption-home.png)
+ ; ?>/assets/img/features/encryption-default.png)
+ Security information
-This page hosts our security policies and information with regards to reporting security flaws. You can follow our advisories via RSS.
+This page hosts our security policies and information with regards to reporting security flaws. Learn more about how Nextcloud offers the best security in the open source file sync and share industry here. You can follow our advisories via RSS.