Overview
Most document-security evaluations fail for the same reason: every vendor looks equal in a slide deck. The differences that matter later — can an authorized user take the file? does the original ever reach the endpoint? can you prove who saw what? — are exactly the ones that do not appear in a demo unless you ask. This guide turns the decision into twelve verifiable questions, each with the evidence to demand before you sign.
Start from the threat model, not the feature list
Before comparing products, write down the two or three flows that would hurt most if they leaked: a bid package, a clinical record, a board deck, a reservoir study, a client's source code. Evaluation criteria should be anchored to those flows, not to a checkbox matrix.
Then decide which of the two procurement realities you are in: keeping documents in your own infrastructure (on-premise and sovereign) or accepting a managed cloud. That single decision filters most of the market before you read a single datasheet.
Finally, separate the layers. A platform should be evaluated on access control, delivery model, traceability, and deployment — four independent questions. Vendors who answer only the first one are file-sharing tools with a security story.
- Identify the crown-jewel flows — the documents whose leak triggers legal, regulatory, or commercial damage.
- Choose the deployment model first: on-premise, air-gapped, or cloud — driven by regulation and sovereignty, not convenience.
- Score the four layers separately so a strong feature cannot hide a weak foundation.
The twelve questions (and the proof to demand)
Ask each question twice: once as a promise and once as a test. A serious vendor will let you run the test on a live environment during the evaluation, with your own scenarios — not just theirs.
The questions fall into four groups — access, delivery, traceability, and deployment — and each one maps to evidence you can demand: a live demonstration, a log export, a policy simulation, an architecture diagram, a licensing model.
If a vendor answers that depends without following with a concrete mechanism, treat it as a no. In document security, ambiguity is where leaks live.
Access: who can see it — and can they keep it?
The first group decides the classic question: what can this person do with this document? Separate listing, viewing, and downloading; a platform where viewing implies possession has already failed.
Then test how decisions are made: policies should be deterministic (default-deny, explicit grants) and provable before they ship — not the accumulated result of nested shares.
- View vs. download raw: is obtaining the original file an explicit, separate permission?
- Default-deny determinism: can the vendor show the exact policy statement behind a decision?
- Scoped, expiring access: can permissions be limited to a folder, a project, or a window of time — and revoked automatically?
- Simulation: can you test a user's effective access before publishing a change? See how the Aegis Shield policy engine answers this one.
Delivery and traceability: what actually reaches the user
A document you can download is a document you no longer control. Ask how content reaches the screen: ideally the server renders pages to pixels and never transmits the original — the architecture behind server-side PDF rasterization.
Traceability is the second half. Every viewed page should carry a forensic watermark bound to the viewer and session, and every access should land in an immutable audit log.
Demand an export: if the audit trail cannot be exported and filtered by user, document, and date, you have a log — not evidence.
Deployment and proof: where it runs, and how you verify
The final group decides whether any of the above survives your environment — your network, your regulators, your constraints.
- Sovereign deployment: on-premise and air-gapped options with full functionality.
- Live proof, not slides: a real evaluation environment with your scenarios for a defined period.
- Licensing clarity: how the product is licensed (per instance, per user, offline) and what happens when connectivity or renewal fails.
- Operational fit: identity integration, storage targets, support model, and upgrade path — the boring details that decide whether the platform is still deployed in year three.
A buyer's guide is only useful if it changes the conversation: from features to evidence. The right platform keeps documents under custody, proves every decision, and runs where your rules require. If your team is shortlisting vendors — or preparing to be evaluated by one — request a demo and we will run this checklist live against your own scenarios. If you are new to the category, start with What is EDRM?. For the deal-room version of this problem, our guide to M&A data rooms and virtual data rooms applies the same questions to a live transaction.