> For the complete documentation index, see [llms.txt](https://docs.expandrive.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expandrive.com/security.md).

# Security

ExpanDrive connects your computer directly to each storage provider. It does not proxy file traffic through ExpanDrive infrastructure.

## Encryption

ExpanDrive uses Transport Layer Security (TLS) or the connection protocol's native encryption when the selected service and connection settings support secure transport.

Plain FTP and endpoints configured with `http://` send credentials and file contents without encryption. Use FTPS, SFTP, or HTTPS whenever the server supports them. If an unencrypted protocol is unavoidable, protect the connection with a VPN or another encrypted network layer.

## Credential Storage

ExpanDrive stores passwords, SSH keys, and OAuth tokens in the operating system's credential store: [macOS Keychain](https://support.apple.com/guide/keychain-access/what-is-keychain-access-kyca1083/mac), Windows Credential Manager, or the equivalent system credential store on Linux. It does not write these credentials to a plaintext configuration file or transmit them to ExpanDrive servers.

## OAuth Authentication

Cloud storage services such as Microsoft, Google, Box, and Dropbox use OAuth 2.0 to authorize applications. ExpanDrive opens the provider's sign-in flow in an embedded browser, so you authenticate directly with the provider and ExpanDrive does not receive your password.

After authentication, the provider issues a scoped token that ExpanDrive stores in the operating system's credential store. The provider's sign-in flow can include multi-factor authentication and single sign-on through services such as Microsoft Entra ID, ADFS, Okta, Duo, or Google Workspace.

### OAuth Example

This example shows Google Drive, but the process is the same for OneDrive, OneDrive for Business, SharePoint, Dropbox, and Box.

![Authentication is performed using an embedded browser.](https://1753538908-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M1WQstUIV0CAuN58yGb%2F-M1WRQh5U9IrFLnxXHjd%2F-M1WRucvd13C0bM3ZIkj%2Fimage.png?alt=media\&token=3f00fca4-ef72-47d4-89ca-dc80a9ff0df0)

ExpanDrive starts the authentication by connecting directly to Google via an embedded web browser view. The ExpanDrive app never captures the user's credentials.

![After authentication, the user authorizes ExpanDrive to access Google Drive.](https://1753538908-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M1WQstUIV0CAuN58yGb%2F-M1WRQh5U9IrFLnxXHjd%2F-M1WRxvqD1I4ySXdGEEg%2Fimage.png?alt=media\&token=ed731afe-aaeb-4109-a0a6-54fee4333ab6)

The web-based authentication grants the ExpanDrive app access to read and write from the user's Google Drive account on behalf of the user.

Google creates an OAuth token to represent this authorization.

This is how ExpanDrive transforms a Google Drive account into a virtual drive.