Dropzippa
Sign inCreate account

Files, where
you want them.

Install the agent on a machine, tell it which folders it may touch, then download, unzip, copy and move files there from your own software — over an API, without opening a port or handing over the whole disk.

Create accountHow access works

Scoped file operations

A folder, an API, and a hard boundary.

Roots

Folders you choose, and nothing else

The agent exposes named folders — orders, inbound, archive. Your API calls address a root by name and never see an absolute path, so nothing outside the folders you declared is reachable.

Operations

Eight verbs, one ordered list

Create directories, download files, copy, move, unzip, zip, write and delete. A job is an ordered list of these, applied together on the target machine.

Durable jobs

Submitted once, applied once

Jobs are claimed under a lease and heartbeated while they run. An agent that loses power mid-job releases its lease and the work is retried — but an applied job is never re-applied.

All or nothing

No half-finished folders

Every write is staged inside the destination root and published only once every operation in the job has succeeded, so a failure leaves nothing that looks complete.

No execution

It moves files, it does not run them

There is no run, shell, or open-with operation anywhere in the API. The agent cannot launch what it delivers, and that is a property of the product rather than a setting.

Per-agent credentials

Revoke one machine, not all of them

Each installed agent gets its own credential, stored hashed, revocable on its own. Nothing is shared between machines.

How a job runs

From your backend to a folder on a machine you control.

You submit an ordered list of operations. The agent claims the job, applies it inside its permitted roots, and reports the outcome back.

Your applicationJobLocal agentPermitted folder

One job record

Follow the job through pending, claimed, running, applied and done.

Local enforcement

The agent decides what its roots mean, after resolving every symlink.

Visible failures

A refused operation returns the reason it was refused, and it is kept.

POST /api/jobs
{
  "computer_id": "cmp_…",
  "title": "Deliver order 4192",
  "operations": [
    { "op": "mkdir",
      "root": "orders", "path": "4192" },
    { "op": "download",
      "root": "orders",
      "path": "4192/artwork.zip",
      "url": "https://…",
      "sha256": "9f2c…" },
    { "op": "unzip",
      "root": "orders",
      "archive": "4192/artwork.zip",
      "into": "4192/artwork" }
  ]
}
202 Acceptedjob pending — 3 operations
Integration

One call at the application boundary.

Build the operation list in your backend. Everything about where those folders actually live, and whether the path is allowed, stays on the machine with the agent.

Downloads can carry an expected SHA-256. If the bytes do not match, the file is never published.

See what it can do
Pricing

Priced by the operations you actually run.

Plans, monthly operation allowances, agent counts and log retention come straight from the billing catalogue. Start free, with no card.

View current pricing

Pick the folder.
Keep the keys.

Create account

Frequently asked questions

What gets installed on the machine?

A small Windows agent. It connects outbound to the Dropzippa API, so the machine needs no public IP, no inbound port and no change to your firewall.

Can the API reach any folder on the machine?

No. The agent reads its roots from a local configuration file that only someone with access to that machine can edit. The API names a root; it cannot add one, widen one, or address a path outside it. Requests that resolve outside a root are refused by the agent, not just by the server.

What happens if the machine goes offline mid-job?

The job's lease expires and it returns to the queue for another attempt. Because writes are staged and published atomically, a partially applied job leaves nothing behind. Jobs that have reached the applied state are never retried.

Can it execute or install what it downloads?

No. There is no operation that runs a file. Roots can also be restricted to an explicit list of allowed extensions, so a folder that should only ever receive PDFs will reject anything else.

How does my application authenticate?

With an API key created in the dashboard, scoped to the operations it needs. Keys belong on your server and should never be embedded in browser code.

Where is Dropzippa available?

Dropzippa is available to businesses in India, billed in INR.