DocShare replaces password-protected attachments with a single-use encrypted link. The document is sealed with its own AES-256-GCM key, the key lives in a hardware security module, and it is released only after the recipient passes verification.
In production at
The problem
A password-protected PDF sent over email is protected by two things: a 40-bit-equivalent cipher from 1999, and a password that was almost certainly sent in the next message. Once delivered, the file is out of your control — forwarded, archived on a mail server in an unknown jurisdiction, and readable by anyone who reaches the mailbox.
Attachments are copied the moment they land. You cannot revoke them, expire them, or find out who opened them.
Supervisors ask who received a document and when. A sent-items folder is not an answer a regulator accepts.
The second email with the password defeats the encryption entirely. Everyone knows it; everyone still does it.
Mail transits providers you did not choose. Under GDPR, "probably in Europe" is not a lawful basis.
How it works
The sender uploads once. Everything after that is automatic — and every step is written to a tamper-evident log.
Before the file leaves the sender's browser it is encrypted with a freshly generated 256-bit data key. That key is itself wrapped by a customer-specific master key held in our HSM cluster — envelope encryption, so the plaintext document and the unwrapped key never exist on the same machine at the same time.
AES-256-GCM SHA-256 manifest
An email arrives containing nothing confidential: no attachment, no password, no description of the contents. Just an address on a subdomain reserved for the sending organisation, carrying a single-use reference to the encryption record.
Single-use Expires in 14 days
Opening the link shows the document's shape but none of its content — the page count, the layout, the fact that it is genuinely waiting. Nothing readable has been transmitted to the browser yet; the blur is a placeholder rendered from the encrypted manifest, not a filter over readable text.
Pressing Unlock PDF starts a sequence of checks: the transport channel, the integrity of the encryption record, the reputation of the device, and the availability of the key custodian. The password field stays disabled until every check returns green. If one fails, the session ends there — there is nothing to brute-force.
The passphrase — agreed out of band, by telephone, in branch, or from a document the recipient already holds — is stretched with Argon2id and used to unwrap the data key inside the HSM. The plaintext key is returned to the recipient's browser for the length of the session and never written to disk on either side.
Argon2id FIPS 140-2 Level 3 HSM
Anatomy of a DocShare link
https://rijnbank.doc-share.online/?encryptionId=6f1a9c84-2e57-4d0b-9c33-af51d7e0b2a9
What the recipient sees
The verification sequence is shown to the recipient in full. Nothing happens silently: each check names itself, resolves, and leaves a mark. It takes a few seconds, and those seconds are the difference between "a PDF turned up" and "a document was released to me, and someone can prove it".
Shown live in the unlock dialog.
encryptionId is matched to a live, unexpired shareCryptography
We do not invent ciphers. Every algorithm below is published, peer-reviewed and on the approved lists of NIST and the Dutch NCSC. The engineering is in how they are combined, and in who is able to reach the keys.
Every document is encrypted with its own 256-bit key and a unique 96-bit nonce. GCM gives authenticated encryption, so a modified ciphertext fails to decrypt rather than decrypting to garbage.
Modern cipher suites only, forward secrecy mandatory, TLS 1.0–1.2 and all RSA key-exchange suites disabled. Certificates are issued per tenant subdomain and monitored in Certificate Transparency logs.
Data keys are wrapped for transport using hybrid key encapsulation. Tenant master keys never leave the HSM boundary in plaintext form, under any operational circumstance.
Recipient passphrases are stretched with Argon2id (m=64 MiB, t=3, p=4) and a per-share salt. The derived value unwraps the key; the passphrase itself is never stored, logged or transmitted in clear.
Master keys are generated inside, and never exported from, a tamper-responsive hardware security module cluster operated in two Dutch data centres under dual control.
Each share carries a signed manifest: document digest, page count, sender identity and policy. Any divergence between manifest and ciphertext aborts the release.
AES-256-GCM — 256-bit data key, 96-bit nonce, 128-bit authentication tag, unique per document version.AES-KW (RFC 3394) against a tenant master key resident in the HSM partition.Argon2id, 64 MiB memory cost, 3 iterations, 4 lanes, 128-bit random salt stored with the encryption record.TLS 1.3 with X25519 key agreement; HSTS max-age=63072000; includeSubDomains; preload.Ed25519 over a canonical JSON manifest; public keys published in our trust centre.X25519 + ML-KEM-768 in limited release for key encapsulation; general availability targeted for 2027.Our partners
DocShare is deployed inside banks, insurers, pension administrators and notarial practices. Several of them helped design the verification sequence their own customers now see.
Rijnbank N.V.
Partner since 2018
Vondel Verzekeringen
Partner since 2019
Batavia Bank
Partner since 2020
Nederlandse Handelsbank
Partner since 2017
Zuiderzee Assurantiën
Partner since 2021
Maasstad Pensioenen
Partner since 2019
Hollandsche Waarborg
Partner since 2022
De Waal & Partners
Partner since 2020
In their words
Our complaints about "I never received the mortgage offer" dropped to almost nothing. We can now show exactly when a document was released, and to which verified session.
The verification sequence is the part customers actually comment on. They see the checks run, and they believe the document is genuinely theirs. That trust is worth more than the cryptography we bought it with.
DNB asked us to evidence the confidentiality of outbound client correspondence. We exported eleven months of DocShare audit records and the question was closed in a week.
Compliance
Certification reports, penetration test summaries and our sub-processor register are available under NDA through the trust centre. Every share produces an immutable audit record: who sent it, which checks ran, when the key was released and from which network.
Questions
Next step
Twenty minutes, your own document, your own subdomain. We will send you a real link and walk through the verification sequence together.