How I Built a Secure File Transfer App with Django, ClamAV, and Cloudflare R2

Rudra Bhairav — Tue, 21 Apr 2026 06:56:51 +0000

I recently launched TransferSecure, a file transfer platform built for sending large files to clients and collaborators without forcing them to create an account. Here is a breakdown of how it works under the hood.

The Stack
Backend: Django 6 + Django REST Framework
File Storage: Cloudflare R2 (S3-compatible) via boto3
Virus Scanning: ClamAV via pyclamd
Task Queue: Celery + Redis
Database: PostgreSQL
Frontend: Django templates + Bootstrap 5 + vanilla JS

The Upload Flow
The browser never uploads files through Django. Instead:
The frontend requests presigned upload URLs from the backend
Files are uploaded directly from the browser to Cloudflare R2 using those URLs
Once all parts are uploaded, the frontend calls a confirm endpoint
Django sets the transfer status to scanning and triggers a Celery task
The Celery worker streams each file from R2 directly into ClamAV without writing to disk
Once scanning is complete, the transfer becomes active and recipients are emailed
This keeps Django out of the upload path entirely, which means no memory pressure on the server regardless of file size.

Virus Scanning
ClamAV scans files up to 200 MB by streaming them directly from R2 into the ClamAV daemon via pyclamd. Files larger than 200 MB are accepted but bypass active scanning due to stream length constraints — this is disclosed in the terms of service.
If a virus is detected, the file is deleted from R2 immediately, storage quota is refunded, and the infected file is excluded from the transfer. If all files in a transfer are infected, the transfer is marked deleted and recipients are never notified.

Anonymous Sending
Registered accounts are not required to send files. Anonymous senders verify their email via a 6-digit OTP before uploading. This gives just enough identity verification to prevent abuse without forcing sign-ups.

Multipart Uploads
Files above 100 MB use S3 multipart upload. The frontend splits the file into 10 MB chunks, uploads each part with a presigned URL, and calls a complete-part endpoint for each chunk. The backend tracks part completion and finalizes the multipart upload once all parts are confirmed.

What I Learned
Streaming files from R2 into ClamAV without touching disk works well in practice but requires careful handling of ClamAV's StreamMaxLength limit
Presigned URLs for direct browser-to-R2 uploads eliminate a whole class of server memory and timeout problems
Celery's retry mechanism is essential for ClamAV — if the daemon is temporarily unavailable, the task retries with backoff instead of silently failing
Live at: transfersecure.ai

Happy to answer questions about any part of the implementation.

DEV Community: Rudra Bhairav

How I Built a Secure File Transfer App with Django, ClamAV, and Cloudflare R2