Viewer Guide

When your admin creates your account, the first login walks you through setup. You will enter your names, pick a username, provide your email, and set a master password. Store that password somewhere safe — Aegis does not keep a recoverable copy.

Next, the setup wizard asks you to configure TOTP two-factor authentication. Scan the QR code with any authenticator app (Google Authenticator, Microsoft Authenticator, Authy, and so on), then type the 6-digit code to prove the pairing worked. From then on, every login asks for your username or email, password, and a fresh TOTP code.

• Use a password manager if your organization allows it.
• If an admin enables trusted-device policy, you can check Remember this device after a successful 2FA.
• A captive 2FA portal may appear if a Shield rule requires MFA for a specific resource.

The Virtual File System browser works like a regular file manager, but every action is filtered through your permissions. The URL reflects the current folder (`/browse/:folderId`), so you can bookmark a location or refresh without getting lost.

Depending on what you are allowed to do, you will see buttons to create folders, upload files, refresh, or index text in the current folder (admins only). The list view shows an icon for each file type, the file size, and a Processed badge when a document has been indexed for search.

• Right-click a file to download the original or delete it — only if your policy permits those actions.
• Use the filter to show only directories with searchable text.
• Files you cannot read are simply not visible; the UI does not tease you with locked icons.

Double-click any file to open it in a tab. Aegis Secure View supports PDFs, common image formats (jpg, png, gif, bmp, webp), and Office files (doc, xls, ppt, and their modern equivalents). Office documents render through an embedded OnlyOffice session configured as view-only.

The critical thing to remember: the original file never reaches your browser. The server rasterizes pages in memory and streams sealed pixels. You see the document exactly as intended, but there is no PDF or DOCX sitting in your downloads folder or browser cache.

The header shows the filename, an in-document search box, a shortcuts button, and a close-tab control. The footer gives you everything you need to move around the document comfortably.

• Toggle the thumbnail sidebar to skim pages quickly.
• Use previous/next arrows, the page-number input, or the view-mode switch between single page and continuous scroll.
• Zoom out/in, rotate left/right, fit width (W), or fit the whole page (0).
• Thumbnails are virtualized, so even thousand-page documents stay responsive.

The viewer is designed to be keyboard-first. Press ? at any time to open the shortcut reference. Here are the essentials:

• Arrow keys — navigate pages.
• + / - — zoom in and out.
• 0 — fit the whole page.
• W — fit width.
• R — rotate clockwise.
• Ctrl/Cmd + K — open the global search palette.
• Ctrl/Cmd + wheel — zoom with the mouse while holding the modifier key.

Press Ctrl/Cmd + K or click the search icon to open the search panel. The panel shows how many matches exist, lets you sort by relevance or page order, and displays ranked snippets around each hit.

Click any result and the viewer jumps straight to that page. This works because the text index lives on the server; you are not searching a local copy of the file.

Every page you view is overlaid with a forensic watermark. The template can include your company name, username, full name, email, IP address, and a timestamp. Admins control the opacity between 5% and 50% so the mark is visible enough to deter leaks but light enough to read through.

The DocumentProtection layer adds additional guards: the view blurs when the window loses focus, PrintScreen and the PrtSc key are blocked, and common save/print shortcuts like Ctrl+S and Ctrl+P are intercepted. The client also blocks right-click context menus, copy/cut, and drag operations. If you are curious about the threat model, NIST SP 800-207 on Zero Trust is a solid reference for why layered client-side controls matter.

Most deployments disable downloads by design, but some policies allow it for specific users or file types. When you right-click a file and see Download Original, that means a Shield policy explicitly granted you the `DownloadFile` action on that resource.

If the option is missing, your admin has decided the document should stay view-only. Do not ask IT to turn it on casually — that permission is a deliberate exception, not a default.

Where your role allows downloads, an entire folder can leave as a single ZIP archive. From the folder's context menu, choose the download option: Aegis first shows a preflight summary — how many files are included, the total size, and which files your permissions exclude — before anything is transferred.

The same summary appears when you select multiple files for a batch download. Archives are built over your current session, logged file by file in the audit trail, and files you cannot read are simply never included.

• Large archives trigger a warning in the summary; beyond the maximum threshold the download is blocked — split it into smaller batches.
• A file marked as excluded means a folder-level rule (ACL) restricts it; ask your administrator.
• Downloading originals may be limited to trusted networks defined by your administrator.

A few common issues and what they usually mean:

• The document looks blurred — the protection overlay activated because the viewer window lost focus. Click back into the window to restore clarity.
• A shortcut does not work — the client intercepts Ctrl+S, Ctrl+P, F12, and context-menu keys to prevent extraction. This is expected behavior.
• I cannot download a file — either you do not have the `DownloadFile` permission, or the global policy blocks downloads for that file type or folder.

If something still feels off, check with your admin or request a demo and we will walk through the viewer on your own documents.