Positioning19 Aug 2026
Governed content has to outlive the transaction
External sharing matters, but organisations also need content that survives the deal and stays governed afterwards.
Read insightInsights
How we think about secure content: written plainly.
Short notes on sharing, permissions, retention, audit, residency and the API. No feature theatre.
Secure sharing19 Aug 2026
A share needs its own recipient, version and lifetime
When a sensitive file leaves the organisation, control should travel with the act of sharing, not disappear into a copied link.
Read insight
Secure sharing19 Aug 2026
Prove the recipient before serving sensitive content
Putting an email on an invitation is an intention. Recipient proof turns that intention into a stronger access decision.
Read insight
Secure sharing19 Aug 2026
Bind external access to the version that was approved
“Latest” is convenient inside a team. It can be dangerous when an external recipient was approved to see something specific.
Read insight
Security19 Aug 2026
Staff work and external access are different trust surfaces
The person opening a public share and the employee in a workspace should not inherit the same assumptions.
Read insight
Security19 Aug 2026
Identity answers who. Authorisation answers what next.
Knowing who is asking is essential. Deciding what they may do with a specific file is a separate responsibility.
Read insight
Authorisation19 Aug 2026
Signed in is not the same as allowed
Knowing who you are is the start. What you may do with a sensitive file is a second question the product still has to answer.
Read insight
Security19 Aug 2026
Session revoke should take effect in the product
Ending access to content is a product decision, not a hope that the user’s password somehow disappeared.
Read insight
Governance19 Aug 2026
A hold should be obvious the moment someone tries to delete
Legal or investigative hold only matters if the product actually changes behaviour when somebody tries to remove the file.
Read insight
Governance19 Aug 2026
Retention says when content must remain
Retention is a policy about the life of a business record, not a longer delay before emptying deleted items.
Read insight
Governance19 Aug 2026
Classification should speak your organisation’s language
A useful label is one your team already understands, not a badge invented to fill a feature checklist.
Read insight
Regional control19 Aug 2026
Home region should be an organisation property
When placement matters, make it explicit enough to fail closed, not something the system guesses under pressure.
Read insight
Auditability19 Aug 2026
Who opened the file should be a question the product can answer
If you have to dig through mail and logs to answer an ordinary content question, the useful context never made it into the product.
Read insight
Security19 Aug 2026
Automation needs its own machine identity
Borrowing a human credential looks convenient until something goes wrong and nobody can say which principal did what.
Read insight
Developers19 Aug 2026
Treat outbound events like an API you publish
Integrations stay calm when event delivery is documented, authenticated and boring enough to run every day.
Read insight
Developers19 Aug 2026
Create once, even when the client tries twice
Reliable automation assumes retries. The API should help them succeed without creating the same thing twice.
Read insight
Developers19 Aug 2026
Failures should be structured, not cryptic
When something goes wrong, both your software and your on-call person should be able to tell what kind of failure it was.
Read insight
Architecture19 Aug 2026
Keep the public website outside the product trust path
A marketing site and an authenticated content platform have different jobs. Keeping them separate reduces unnecessary risk.
Read insight
Trust19 Aug 2026
How we publish product and assurance claims
A security website is more credible when public language stays inside the evidence available to support it.
Read insight
Evaluation19 Aug 2026
Evaluate with a real workflow, not a feature checklist
Feature lists are easy to match. Product behaviour shows up when you walk a few uncomfortable scenarios end to end.
Read insightTalk to us
Have a product question worth unpacking?
Bring one real file and the rule that must not break. We prefer that to a feature checklist.