By default, Session uses the Oxen File Server for attachment sending and storage. The Oxen File Server is an open-source file server run by the Oxen Privacy Tech Foundation — the creators of Session. When you send an attachment, the file is symmetrically encrypted on the device and then sent to the Oxen File Server.
The current 10MB file transfer limit is due to limitations with the onion request protocol. While privacy preserving, onion requests are unable to support the transfer of large files. We are currently investigating methods to increase this limit which we hope to bring to future versions of Session.
