Skip to main content

What Gets Scanned

Malware Scanning checks files uploaded into a folder. Whether a given file is checked depends on how it arrived.

What Counts as an Upload

Files.com scans a file uploaded into a protected folder through any interface, including the web interface, the Desktop App, the Files.com CLI, the API and SDKs, and the file transfer protocols. It also covers uploads from outside your user base, through an Inbox or an upload-enabled Share Link. Files that a Sync delivers into a protected folder are scanned as well.

When the folder is a configured Remote Server Mount, Files.com holds the file and scans it before sending it on. An infected file never reaches your remote storage or your partner's server.

Where the Scan Runs Among Your Other Folder Settings

When a protected folder has other Folder Settings on it, Malware Scanning runs before them. The scan sees the file exactly as it was uploaded.

If the folder also has GPG Decryption, what arrives is an encrypted file. The scan reads the encrypted form, so its result tells you nothing about the decrypted contents. Files.com decrypts the file afterwards.

GPG Encryption is not affected. The file arrives as plaintext, the scan reads it normally, and Files.com encrypts it afterwards.

If the folder also has Auto Unzip, the scan checks the archive first. Files.com extracts it only when the scan finds no threat.

Routes That Never Trigger a Scan

These paths into your storage bypass the upload pipeline, so a Malware Scanning setting on the destination folder has no effect on them.

  • Automatic Remote Server Mounts, reached through the underscore folder at _/RemoteServers/. They are a routing path rather than a folder you configure settings on.
  • Child Site automounts at _/Sites/, which work the same way.
  • Writes made directly to your external storage, outside Files.com. A file placed straight into your S3 bucket or onto your SFTP server by another system arrives in a mounted folder without passing through any Files.com upload.

Offset and Append Uploads Are Rejected

Malware Scanning needs a complete file, so an upload that writes a file in place across multiple requests is rejected. An offset or append upload into a protected folder fails. Upload the complete file instead.