Ephemeral keys.
Share specific files across clients, teams, or outside counsel with one-time-use, time-limited keys that expire and self-destruct after use. The recipient gets the file. Nobody gets a permanent door.
Store any file. Hand out access that expires.
File Vault is an encrypted file storage API for documents, images, and any sensitive file. The file lives in the vault. Your app holds a reference, never the contents. Access happens through short-lived presigned URLs.
PCI DSS Level 1SOC 2 Type IIAWS Partner
The problem
A file on your servers is a file in your breach scope. Forever.
Every sensitive document on your infrastructure is also in your backups, your logs, and your incident report, indefinitely. Retention policies do not reach the copies.
- Backups keep a copy long after the record is deleted
- Logs and error reports leak file paths and contents
- Shared drives grant access nobody remembers granting
- Every copy is one more thing to disclose
Instead
File Vault takes the document out of your stack entirely. Your application stores a handle, requests a time-limited URL when someone needs the file, and never holds the bytes.
Free tier
Five gigabytes of encrypted storage, free forever.
The lifecycle
How encrypted uploads and downloads work.
Collecting documents from customers without an integration? That is Customer Vault.
Four stages, and your servers appear in none of them.
01
Upload by presigned URL.
Your app requests an upload URL and the client sends the file straight to the vault. The bytes never transit your servers.
02
Encrypted at rest.
AES-GCM envelope encryption: a unique data key per file, wrapped by your account's own encryption key. Tampering is detectable, not just prevented.
03
Track in real time.
File status streams over WebSocket, so your application knows the moment an upload completes or a download happens, without polling.
04
Download by expiring link.
Access goes through short-lived presigned URLs. When the link dies, so does access.
Access and evidence
Sharing without standing access. And a record of every touch.
Every touch on the record.
Upload, access, and download events all logged with client ID, IP, and response status, with full distributed tracing. When a regulator or customer asks who opened a document and when, the answer is a query, not an investigation.
Where it lands
Where teams point it first.
Any document that moves between you and somebody outside your building.
Contracts and signed documents.
Retainers, agreements, and filings stored encrypted with a complete access history.
Identity documents.
Passports, licenses, and KYC files that should never sit in an application bucket.
Medical and claims records.
Mixed-sensitivity documents held under authenticated encryption with expiring, trackable access.
Transcripts and HR files.
Student records and personnel documents shared across departments through ephemeral keys instead of email.
Large media and evidence.
Files up to 5GB each, uploaded direct-to-vault so nothing large ever passes through your application tier.
Customer deliverables.
Reports and returns handed back through expiring links instead of email attachments.
Platform role
File Vault carries the file side of the whole platform.
It is not only a standalone product. Customer Vault already runs on it, which is why its encryption and audit model is the same one your assessor will see everywhere else.
- Customer Vault stores every intake document here
- One encryption model, one audit trail, one compliance boundary
