On-premise EDRM · Zero-trust ready
Your documents never leave your control. Neither does our code.
Aegis Secure View is a cryptographically secured document viewer and Enterprise Digital Rights Management pipeline, built to run inside untrusted customer environments. It protects both your data and the platform itself.
Core capabilities
Everything a secure document platform needs. Nothing an attacker can use.
Virtual File System
Maps physical SAN/NAS storage into a logical folder structure governed by strict role-based access control. Users see exactly what policy allows. Nothing more.
Frictionless EDRM
PDFs are rasterized directly in memory and sealed with dynamic, pixel-level, forensically identifiable watermarks before streaming. The original vector PDF is never transmitted over the network.
Full-Text Search
Document text is extracted asynchronously and indexed for high-speed contextual discovery across the entire repository, down to the exact page.
Aegis Shield (ASP)
A deterministic, JSON-based policy engine with granular action/resource overrides on a per-user or per-group basis. Access decisions are explicit, auditable, and reproducible.
The EDRM pipeline
From storage to screen, never in the clear
Every document view follows the same hardened path. The original vector PDF is never transmitted over the network. Only sealed, attributable pixels move.
Map
Physical SAN/NAS storage is mounted into a logical, strict-RBAC folder hierarchy. No direct filesystem access is ever exposed to clients.
Rasterize
On request, the PDF is rendered to pixels entirely in memory. Vector content, embedded fonts, and file structure never leave the server.
Watermark
A dynamic, pixel-level watermark is applied to every frame, forensically attributable to the requesting user and session.
Stream
Only the sealed raster buffer is streamed to the browser. Screenshots and leaks remain traceable back to their source.
Zero-leak binary distribution
Deployed in your data center. Impenetrable even there.
Aegis Secure View is purpose-built for untrusted, on-premise environments. A hardened multi-stage compilation pipeline ensures that running the platform never means exposing it.
Read the full security modelEmbedded frontend
The React SPA is compiled and injected directly into the Rust binary’s .rodata segment. No HTML, JS, or CSS files ever exist on disk.
Compiler obfuscation
Built with lto = "fat" and stripped symbols, the executable ships as an opaque, heavily optimized machine-code binary.
Distroless runtime
The production container is FROM scratch: no shell, no package manager, no utilities. docker exec attacks have nothing to execute.
Licensing control plane
Cryptographically leased. Gracefully enforced.
Every deployment operates under a cryptographically signed JWT lease. On boot, the application authenticates against the Aegis Control Plane using an Ed25519 public key embedded in its machine code. If a lease expires, the platform degrades gracefully into read-only mode. Availability is preserved; exfiltration is not.
# lease.status
issuer: aegis-cloud-services
signature: Ed25519 · valid
on_expiry: read-only degradation
See what zero-trust document viewing looks like
We will walk you through a live deployment: the EDRM pipeline, the policy engine, and the hardened runtime, inside your own environment.