Security

Viewing a document never sends you the file

Pages are rendered server-side and delivered as images. Every action is recorded against the person who took it. Every case is isolated in its own storage.

How a document is served

  1. Step one

    Stored encrypted

    Each file is encrypted with its own data encryption key, generated at upload. Where the case has a dedicated KMS key, that key is itself encrypted before it is stored, and the plaintext version exists only in memory for the moment it is used.

  2. Step two

    Rendered server-side

    Pages are rasterised on the server and the browser receives images. Spreadsheets are served as sanitised cell data with formulas stripped, so the workbook itself is not sent. Downloading a document is a separate permission, granted per folder, and every download is recorded.

  3. Step three

    Delivered over expiring links

    Each viewing session gets its own short-lived copies of the page images, delivered over signed URLs that expire after 15 minutes. Documents downloaded in Vault's secured format are watermarked server-side before they are sent — the recipient's email address, IP address and the time, burned into the file. Releasing a document in its original format is a separate permission, and every download is recorded.

Encryption

A bucket per case
Every case gets its own isolated storage bucket. Access to one case's documents does not extend to another's.
Two layers
Storage-level encryption protects every bucket — with the case's dedicated key where one was provisioned, or AES-256 otherwise. Each file is also encrypted individually with its own key, generated at upload. Reading a file requires an authenticated session and the file's own key from the database.
No public access
Every bucket blocks public access at all four levels. Nothing in storage is reachable anonymously — access requires a signed, time-limited URL issued to an authorised session.
In transit
TLS throughout. Page images are delivered over signed URLs that expire 15 minutes after they are issued.

Access and identity

Multi-factor authentication guards every document
Viewing or downloading a document requires a multi-factor-verified token. A password alone does not reach a case or a file.
Access tokens expire after 30 minutes
Access tokens expire after 30 minutes and must be refreshed.
Permissions are per object
Access is granted on individual folders, to a person or a group. Documents inherit their folder's permissions. A denial always beats a grant at the same level, so revoking access is unambiguous.

The audit trail

Every action is recorded before the response is returned — logins, views, downloads, permission changes and failed attempts.

Audit entries are append-only and cannot be edited or deleted through the application by any user, including administrators.

Each entry records who acted, what they acted on, when, and from which IP address.

Where your data lives

Documents, page images, the database and audit records are stored and processed in AWS af-south-1, in Cape Town, which is what POPIA Section 72 requires of personal information that does not leave the country.

No third-party analytics run inside the application. This marketing site is a separate system from the platform your documents sit in.

Reviewing Vault for your firm?

We will walk your security team through the architecture and answer questions in writing.

Start free trial