01 / Free for everyone

Free for everyone. Paid for organisations.

The Community plan is free, forever. It is not a trial and not a funnel. Businesses pay for the higher limits (longer links, more reads through the API, more devices, a dedicated relay), not to unlock features, and that is what keeps the Community plan free. More reads is not a weaker promise: it is one link a whole team can open, or a counterparty reopening it after a misclick, instead of you sending the file a second time.

Every plan gets the same encryption, the same post-quantum signatures and the same public proof log. Pay for volume, never for security. And pay per organisation, not per user.

The plans and what each one costs are further down this page. Checkout and the full comparison are on the pricing page.

02 / What it does

Scrambled here, unreadable in transit, gone after its last read

ParaSend is the transfer half of Paramant. It runs on the same post-quantum core as ParaSign. Your file is encrypted before it leaves your device, so our servers hold nothing they could hand over or lose.

Locked before it leaves you

Your browser locks the file on your own device. Our servers only ever hold the locked version, never the file itself and never the key that opens it.

Gone after its last read

Nothing is written to disk. The file sits in server memory and is wiped after the last read the link allows. The web app and the extensions delete the file after the first read on every plan. Through the API a paid link can allow more reads: up to 10 reads on Firm and 100 on Enterprise. It goes the same way when the link runs out, whichever comes first.

No account for receivers

The recipient opens the link, gets the file, and that is the whole flow. No account, nothing to install.

It opens on their device, or nowhere

The file is locked to a key registered on the recipient's device, so it opens there and nowhere else, and a file altered on the way does not open at all. The send screen you use for this is the ParaSend web app.

Lock a file for yourself

No recipient, no account: lock a file into a .prmnt container with a passphrase. The file and the passphrase never leave your browser.

Your own server, if you need one

A larger organisation can run its own instance, on our hardware or on its own, with its own limits. That is the Enterprise plan.

03 / How to begin

Three steps to a file that disappears

Sending needs a Paramant account. Receiving needs nothing at all.

Create a free account. No card, no time limit. The Community tier sends with a 1 hour link, and the web app burns it on the first read, forever.
Open the ParaSend web app and pick your file. It is scrambled in your browser before anything is uploaded, so what our servers receive is unreadable, and they keep it in memory only.
Share the link. The recipient opens it and the file is wiped after its last read. On the Community plan the link expires after an hour whether it is opened or not.

04 / Who is behind it

Built in Harderwijk, in the Netherlands

Paramant is a product of Paramantis Solutions B.V. in Harderwijk, the Netherlands. The product is built on choices you can check for yourself: post-quantum signatures, a public transparency log, offline-verifiable documents, and source code you can inspect yourself.

The Community plan is free and stays free; the business plans pay for the servers and keep it that way. Paramantis Solutions B.V. is the contracting and responsible party.

More about Paramant →

05 / The plans

What each plan gives you

Free for everyone · anyone with a browser

Community

€0

Forever · no card required

Encrypted in your browser, key never sent
50 transfers a month
500 MB per file over the live hand-over, on every plan
5 MB per file over a one-time link, on every plan
1 hour link expiry
Burn on first read
Up to 50 retrievals an hour through the API
Up to 5 registered devices for the ParaSend web app

For organisations · the business plans

Firm

€29/mo

excl. btw · charged €35.09/mo incl. 21% btw
Annual €290 excl. · 16.7% off

Everything in Community
100 signatures a month on ParaSign, in the same payment
500 transfers a month
24 hour link expiry
Up to 10 reads per link through the API
Up to 500 retrievals an hour through the API
Up to 50 registered devices
Send history and link management
Webhooks on upload and download
Email notifications via Resend

Enterprise

Custom

Per organisation

Everything in Firm
7 day link expiry
Up to 100 reads per link through the API
No hourly cap on API retrievals
Dedicated relay on our infra or yours
IEC 62443 / NIS2 / NEN 7510 documentation as input for your own compliance process, not third-party certification
Custom DPA terms negotiated in the contract
SLA 99.95%, priority incident response

What the hourly figure counts: fetching a transfer back yourself with your own API key, the route the SDKs and scripts use. A recipient who opens the link you sent goes through the download token instead, and that path is not counted against your hour. Past the ceiling the relay answers 429 until the hour rolls over. The number is outbound_per_hour in relay/lib/tiers.js, the same table the transfer, file size and link limits above come from.

Every tier stores transfers in RAM and every tier uses the same cryptography. There is no lesser encryption at lower tiers. Cryptography is not a paywalled feature at Paramant.

Prices shown excl. btw (VAT). Checkout charges incl. 21% btw: Firm €35.09/mo or €350.90/yr. Checkout and the full comparison are on the pricing page.

06 / The proof

Every claim has a place to check it

You should not have to trust us. You should be able to check. Each point below links to where you can.

We never had it

AES-256-GCM with a key your browser generates. The relay only ever holds ciphertext, never the plaintext and never the key, and it holds it in RAM until its last read burns it. A web app transfer is stored in blocks of a fixed 5 MB, so a block says nothing about the size of the file. The retention row is on the security page.

The wire format, in full

The ParaSend web app uses ML-KEM-768 plus ECDH P-256 hybrid key exchange. The register lists the webapp on the pre-v1 hybrid wire, signature n/a, migrating to v1; ML-DSA-65 signed receipts are live on the v1 wire in sdk-py 3.0.0 and sdk-js 3.0.0. Read the register on the crypto agility page.

You own your keys

Generated on your device, never sent. We see only the public half. Read our rules.

EU soil, EU law

Hetzner Germany, Bunny DNS (Slovenia). No US provider in the data path. Email goes out via Resend, as /privacy sets out. The subprocessors are listed there, and rule 5 states the same claim in full on our rules page.

No third-party requests

Your browser talks only to us. No fonts, CDNs, analytics or pixels. Open devtools and check.

Quantum-ready by default

FIPS 203/204 today, not “soon”. The algorithm register is on the crypto agility page.

Dedicated relays, on the same rules

Enterprise customers run a dedicated relay on our infrastructure or their own, with limits configured per tenant within its RAM budget. The tiers are on the pricing page.

Source-available code

The relay is source-available. Read it on GitHub and run it yourself.

What the compliance documentation is. Architecture documents, security controls mappings and technical reference materials aligned to IEC 62443, NIS2 and NEN 7510. This is documentation you can use as input for your own compliance process. Paramant does not hold third-party certification for these frameworks.

What burn-on-read costs you. A file is wiped after its last read, or on expiry, whichever comes first. There is no disk storage, so a file that is gone cannot be fetched again. Keep your own copy.

Send a file → See pricing →

07 / Developers

Send from your own code

There is an open SDK in JavaScript and Python and a self-host installer. Read the documentation, or run the relay yourself from GitHub.

Send a file that deletes itself after reading.