Security model

Proof is private by default.

Private object storage

Uploaded proof is stored in a private Cloudflare R2 bucket. There is no public bucket URL.

Short-lived upload tickets

Uploads go directly to Cloudflare with a one-use ticket that expires after ten minutes.

Scoped review access

Only the claimant and authorized reviewers for that campaign can open its proof files.

Retention limit

Proof for terminal claims is removed after the configured retention window. V1 uses 30 days.

Important: SwitchOffer V1 does not automatically redact invoices. Upload only the minimum evidence needed. Cover unrelated account numbers, addresses, or other sensitive data before upload.