document rights management
Send the document. Keep the control.
Vaultline replaces attachments with policy-bound links. The PDF stays encrypted on your server; recipients get a watermarked, view-only window that you can expire, limit to specific devices, or revoke at any moment. Adaptive rendering, content classification, forensic attribution and continuous risk controls change protection while the document is being read.
recipient → authenticate
↓
policy check (authorised? expired? revoked? device allowed? risk score?)
↓
short-lived viewing session
↓
page policy + need-to-know section + live risk band applied
↓
watermarked page or encrypted tiles rendered (progressive disclosure when required)
↓
canary + lineage event written → forwarded to your monitoring systemnew
Adaptive controls, built this release
Progressive disclosure
For the most sensitive files, only a moving reveal window around the cursor is sharp — full page, focus, line, reading window or hidden.
Auto-classification
On upload, pattern rules (or rules plus an AI review) scan the text for keys, credentials, financial data and classified markings, then suggest a security level.
Page & section policies
Mark individual pages or page ranges as normal, restricted, hidden or admin-only — and grant each recipient only the named sections they need to know.
Live risk scoring
Every page request is re-evaluated: new devices, IP changes, impossible travel, sweeping behaviour. Risk steps the viewer up — or ends the session.
Screenshot response
Capture attempts are detected and answered instantly: the page obscures itself, the recipient identity is displayed and the incident is logged.
Security profiles
Deploy with one switch, not dozens of toggles: Standard, Confidential, Sensitive, Critical or Zero Trust — each expands into the full policy server-side.
SIEM forwarding
Every event carries a stable code (DRM-001 … DRM-051) and can stream to your monitoring system through a signed webhook.
Email delivery
Secure links are emailed to recipients straight from the admin panel — with delivery status and failure tracking built in.
One switch per document — five security profiles
Watermarked, tracked viewing.
No download, copy or print.
Device binding, screenshot controls, short sessions.
Progressive disclosure, page policy, risk escalation.
Region-only rendering, fingerprints, continuous re-authorisation.
attribution · provenance · control
Protection that remains useful after access is granted
Trace recipient-specific copies, prove document identity, collaborate without exporting content, and preserve a defensible chain of custody from upload to revocation.
Canary tracing
Every recipient receives a unique, low-visibility marker. Paste a discovered code or phrase into the investigator to trace its source.
Document lineage
Follow the custody trail from creation and classification through every grant, view, incident, revocation and expiry.
Signed manifests
Tamper-evident manifests bind the document hash, owner, version, classification, policy and recipient to a verifiable signature.
Dead man's switch
Documents lock when licence validation exceeds a configurable interval and grace period, without turning an ordinary outage into an immediate lockout.
Protected collaboration
Recipients can comment, ask questions and record approvals inside the viewer. Every action inherits access policy and joins the audit trail.
Blind tile viewer
Zero Trust sessions receive short-lived encrypted page tiles instead of the PDF. Only the authorised region is decrypted and painted in memory.
DLP intake
Email, endpoint and cloud DLP systems can submit findings that raise classification and enforce a stronger profile without ever downgrading protection.
Sovereign deployment
Run the full stack with Docker, PostgreSQL, object storage and PDF.js, with enterprise Kubernetes and identity-provider deployment scaffolding.
What each policy enforces
Encrypted at rest
Every file is sealed with its own AES-256 key. The original bytes never leave the server.
View only
Pages are delivered one at a time. No download, no print, no copy, no text layer to scrape.
Dynamic watermark
Recipient email, timestamp and IP are burned into every page as it is served.
Device limits
Each recipient is bound to a fixed number of registered devices.
Expiry
Set a date and the link stops working, wherever it has been forwarded.
Instant revoke
One click ends access on the very next page request.
Audit trail
Opens, page views, denials, IP, browser, device and timestamp.
REST API
Upload, grant, revoke and export logs programmatically with scoped keys.
Honest limit: no browser viewer can stop a camera pointed at the screen. Watermarking, fingerprints and the audit trail make a leak traceable to one recipient, one device and one moment.