Vaultline
Talk to sales See pricing

Platform

Everything a confidential document needs after it leaves your desk

Vaultline is one system for secure rooms, controlled sharing, review tracking and records disposal. Your counterparties need a browser and an email address — nothing else.

Secure rooms

Purpose-built rooms, not a shared drive

A room is a bounded workspace for one matter, deal or engagement. It carries its own membership list, permission tiers, retention rule and audit stream, so the controls travel with the work rather than with a folder path somebody can move.

  • Templates for due diligence, disclosure, audit PBC and tender distribution
  • Numbered index that stays stable as documents are added or superseded
  • Q&A threads attached to specific documents, with a disclosable history
  • Bulk upload preserving folder structure, up to 100 GB per file
  • Archive to a sealed, read-only record when the matter closes
Rooms — 12 active
Project Aurora — vendor DD
9 members · closes 31 Aug
Active
Kestrel disclosure bundle
4 members · legal hold
Held
FY25 statutory audit
17 members · PBC template
Active
Riverside tender — Lot 3
34 bidders · sealed until 12:00
Sealed

Link expiry

Access that ends on schedule, not on trust

Every invitation and share link carries an expiry. When the date passes the link stops resolving — there is no cached copy to chase, because the recipient never held the file, only a right to view it.

  • Absolute expiry dates or rolling windows measured from first access
  • Per-recipient revocation that takes effect on the next request
  • Optional one-time links that burn after a single successful view
  • Automatic expiry reminders to the room owner seven days ahead
  • Expired-link attempts recorded in the audit trail with source IP
Share links
SPA draft 7 — buy-side counsel
Expires in 6 days · 3 views
Active
Financials pack — Meridian
Expired 04 Jul · 11 views
Expired
Board minutes — one-time link
Consumed 09:14 by A. Rand
Burned
Tender addendum 2 — all bidders
Expires at close of tender
Active

Watermarking

Every page carries the name of whoever opened it

Dynamic watermarks are rendered at view time, per recipient. A screenshot or a phone photograph of a page still carries the viewer identity, the timestamp and the room reference — which changes how people treat a document they were told not to circulate.

  • Recipient name, email, timestamp and room ID rendered on view and print
  • Configurable opacity, tiling and placement per room or per document
  • Applies to PDF, Office formats and images through the in-browser viewer
  • Print-to-PDF retains the watermark; screen capture is discouraged, not claimed to be blocked
  • Optional "view only" mode where no download path exists at all
Viewer — SPA draft 7
Page 14 of 96
Watermark: j.tamm@harbourlane.example · 11:42
View only
Download
Disabled by room policy
Blocked
Print
Allowed — watermark retained
Logged
Session
00:12:41 elapsed · 22 pages viewed
Recording

Granular access control

Permission tiers that map to how firms actually work

Access is expressed as a role scoped to a room, a folder or a single document. Roles are additive and the most restrictive rule wins, so an over-broad invitation cannot quietly widen access to a restricted sub-folder.

  • Roles: owner, administrator, contributor, reviewer, view-only and auditor
  • Folder and document level overrides, with inheritance shown explicitly in the UI
  • Domain-based invitations so only addresses at a counterparty firm can accept
  • Enforced MFA, IP allow-lists and device checks on Enterprise plans
  • SAML 2.0 SSO with SCIM provisioning and automatic deprovisioning on leaver events
Permissions — Project Aurora
Buy-side counsel (4)
Reviewer · no download · expires 31 Aug
View only
Vendor finance team (3)
Contributor · folder 02 only
Scoped
External auditor
Auditor · read-only incl. activity log
Auditor
Deal lead
Owner · full control
Owner

Activity audit log

An append-only record of who did what, and when

Every action against every object writes an immutable event: uploads, views, downloads, print jobs, permission changes, failed access attempts, expiries and deletions. Events cannot be edited or removed by any user, including account administrators.

  • Actor, action, object, timestamp (UTC), source IP and user agent on every event
  • Filter by person, document, date range or event type; export to CSV or JSON
  • Streaming to your SIEM over webhooks, or scheduled S3-compatible delivery
  • Retained for the life of the account and 12 months beyond termination by default
  • Tamper-evident: each event is hash-chained to its predecessor
Activity — last 24 hours
DOCUMENT_VIEWED
j.tamm@harbourlane.example · 11:42:07 · 94.140.x.x
View
PERMISSION_CHANGED
k.magi@vaultline · reviewer → view-only
Change
LINK_EXPIRED
Financials pack · automatic
Expiry
ACCESS_DENIED
unknown@—.example · expired token
Denied

Retention policies

Disposal that happens on time, with proof

Set a retention rule once and let it run. Rooms and documents are dispositioned against a schedule you define — seven years from matter close, two years from last access, or a fixed date — and the disposal itself is evidenced.

  • Schedules by room template, matter type, client or document class
  • Trigger on matter close, last access, upload date or an explicit review date
  • Mandatory review step before destructive disposal, with a named approver
  • Legal hold that suspends disposal across matched rooms until released
  • Disposal certificate listing what was destroyed, when, and under which rule
Retention — schedules
Litigation files
7 years from matter close · review required
38 rooms
Audit engagements
6 years from sign-off
112 rooms
Tender packs
2 years from award
19 rooms
Kestrel matter
Legal hold — disposal suspended
Held

E-signature handoff

Hand a document to signature without losing the chain

When a document is ready for execution, hand it to your e-signature provider from inside the room. The signed original returns to the same room, indexed against the draft it came from, and both sides of the handoff are written to the audit trail.

  • Connectors for the major EU qualified and advanced e-signature providers
  • eIDAS-aligned advanced and qualified signature workflows supported by the provider
  • Executed copy filed automatically against the originating document version
  • Signature status visible in the room without leaving Vaultline
  • Handoff and return events recorded, including provider transaction reference
Signature status
SPA — execution version
Sent to provider 15:20 · 4 signatories
Out for signature
NDA — Harbour Lane
Completed 09 Jul · QES
Executed
Engagement letter
Declined by counterparty · returned
Returned
Board resolution
Draft — not yet sent
Draft

Also included

The details that make it usable on a Tuesday

Browser-only for guests

Counterparties never install anything or create a password if you don't want them to — an emailed one-time code is enough.

Outlook and Gmail add-ins

Replace an attachment with a Vaultline link from inside the message you were already writing.

In-browser viewer

PDF, Office, images and CAD previews render without downloading, so view-only really means view-only.

Engagement reporting

See which bidders read which schedules, and for how long — useful signal during a competitive process.

Bulk index export

Produce a numbered index of a room as PDF or CSV for court bundles and completion deliverables.

API and webhooks

Create rooms from your practice management system and stream events into your own tooling. See the API.

Ready to stop sending attachments?

Talk to our team about a workspace for your firm, or start with a 14-day evaluation on the Team plan.

Talk to sales See pricing