Security & Privacy
Delivery security
How the board pack is protected in transit and at rest, and why no email ever carries the document or a link to it.
Nothing is ever public
The pack is never served from a public location. Every download requires a valid, short-lived ticket issued to an authenticated portal session.
Two tokens, not one
| Token | Property | Why |
|---|---|---|
| The link | Single-use, stored only as a hash, valid for days | It authorizes a change, so it must be spendable exactly once |
| The session | Short-lived, held in memory for one sitting, revocable | It is presented on every call, so it must not persist in browser storage |
Splitting them is what makes single-use and no-token-in-storage both true at once.
The download itself
A navigation cannot carry a header, so the one route a browser navigates to takes a one-minute, single-use ticket rather than the session. Ownership, state, expiry and the ticket's own identity are all re-checked at redemption. Nothing is taken on the ticket's word.
The bytes come straight from private storage over a short-lived signed URL. That URL is never stored, and never logged in full.
Why the email carries neither the document nor a link to it
An attachment is forwarded and archived beyond anyone's control. A link to a document is a credential sitting in a mailbox indefinitely.
The email carries a link to your portal. The portal then issues the ticket.
The resolver fails closed
If the pointer names a report that is missing, belongs to another engagement, is not in a deliverable state, or is past its expiry, delivery is refused. It never quietly falls back to an older pack you are not currently entitled to. You either get the report the pointer names, or an explanation.
A failed re-run does not destroy your pack
Dispatching a new assessment revokes the emailed link, which is right. It does not clear your existing pack. Only a successful archive of a new run supersedes the previous one.
Assessments fail. Clearing the pointer at dispatch would leave a customer who had received a pack, and then had a re-run fail, with nothing at all.