Is a file I upload to systeme.io private?

What I tested

I uploaded a file under Assets, then Files, and requested its direct address with no session, no cookies and no login of any kind, the way a stranger would if someone handed them the link. It came back HTTP 200, the whole file, as if I were signed into the account.

Where the file actually lives

Not on a systeme.io server directly. The address points at Amazon's CloudFront content delivery network instead, and it carries three things folded into it: the account's own internal ID, a long and unpredictable string of characters, and the file's original name.

What the response headers show, and what they do not

The response told browsers to keep the file cached for a year, and carried a header confirming the file is encrypted at rest on Amazon's storage. Neither of those is about who gets to open the file. The encryption header describes how the bytes sit on Amazon's disks, not who is allowed to ask for them. There was no signature on the address, no expiry date, and nothing behaving like a login token anywhere in the exchange. The address itself was the only thing checked.

It cannot be browsed, and that is the real protection

Asking the CDN to list every file in the account returned 403 Forbidden. Asking for a filename that does not exist also returned 403, not a 404 that would confirm nothing was there. So a stranger cannot browse for your files, and cannot even use a wrong guess to check whether a real one exists at a similar address. What stands between a file and anyone who has not been given its address is the length and randomness of that address. Nothing else does.

What this means for a link you hand out

Once somebody has the address, it keeps working for them for good, whether you sent it to them directly or they got it forwarded from someone you did send it to. The address itself carries no expiry and no separate permission check, so there is nothing about the link that can cut one person off without changing the file behind it for everyone. A file used to deliver a lead magnet or a paid download is only as protected as that address staying between you and the people you meant to give it to.

What I did not test

• Whether a course video is served the same way. Videos inside a course may use a signed or time-limited address instead. Only a file uploaded through Assets, then Files, was tested here.
• Whether a file attached to a paid course or a members area is handled any differently from a file sitting in the general file manager.
• Whether deleting a file removes it from the CDN right away, or whether the one-year cache instruction keeps serving the old copy for a while after.
• Whether the address's random-looking part is generated in a way that could ever be guessed. Nothing here suggests it can be, and nothing confirms it cannot, either.

Where the documentation stands

No systeme.io article says whether an uploaded file's address is public, whether it can expire, or whether access to it can ever be restricted. This test exists because the file manager is a plain way to hand someone a direct download, and nothing published says what that download link actually is.