Everything between your browser and the server travels over HTTPS. Nothing in between can read the contents.
Every file and job carries a company id, and every query filters on it. There is no path from one company's data to another's.
Jobs execute in separate processes and their temporary directories are removed when the job ends.
Free plan files are removed after 24 hours; Team and above keep them for the period the company chooses.
Each link can carry an expiry and a maximum number of downloads.
Administrators can see who touched which file and when.