The secure viewer
See every page. Own none of it.
PDFs, Office and ODF documents, scans, and images open in one multi-pane workspace — rendered and watermarked server-side, never delivered to the device, with every action governed by policy.
| A | B | C | D | |
|---|---|---|---|---|
| 1 | Contract | Value | Status | Due |
| 2 | CNT-2026-0142 | $184,500 | Signed | 12-Sep |
| 3 | CNT-2026-0143 | $96,200 | Review | 30-Sep |
| 4 | CNT-2026-0144 | $250,000 | Draft | 15-Oct |
| 5 | CNT-2026-0145 | $71,800 | Signed | 01-Nov |
Viewer capabilities
Built for the hostile endpoint
Server-side rasterization
Rendering happens entirely on the host. The client never receives vector content, embedded fonts, or file structure. Only a sealed image stream.
Per-frame forensic watermark
Every rendered frame carries a dynamic watermark attributable to the requesting user and session. Screenshots and leaks stay traceable.
Policy-gated downloads
Viewing never hands over the file. The raw original is downloadable only where a Shield policy grants it — every other view stays inside the sealed render pipeline.
Deep-link search navigation
Full-text search results jump directly to the exact page within the viewer. Still watermarked, still protected.
Supported formats
Far beyond PDF
A single, consistent viewing experience across the formats real organizations actually run on — each rendered through its own hardened path.
.pdfPixel-perfect, never delivered. Every page is rasterized server-side at high resolution and streamed as a sealed image. The vector content, fonts, and file structure stay on the server — encrypted PDFs are detected and handled gracefully.
.doc .docx .docm .xls .xlsx .xlsm .xlsb .ppt .pptx .pptm .odt .ods .odp .rtf .csv .txtWord · Excel · PowerPoint · ODF
Embedded Office, read-only by default. Documents open in a server-configured session with download, print, copy, and review disabled — the same dynamic watermark overlaid. Where a policy explicitly grants edit, changes save through the server without a file ever reaching the device.
.jpg .jpeg .png .gif .bmp .webpImages
Same pipeline, same protection. Images flow through the identical watermark compositor as PDF pages, with full zoom, pan, rotation, and fit controls. The raw bytes never reach the browser through the viewer.
.md .log .zip .rar .7z .gz .tar …Everything else
Stored, indexed, governed. Any file type can be uploaded and managed inside the VFS. Names are searchable, access is policy-controlled, and originals are downloadable only where the policy explicitly allows it.
The reading experience
Built for deep work, not quick peeks
A serious document viewer with the ergonomics professionals expect — split panes, pinned tabs, saved groups, precise zoom, and a memory for how you read.
Split-pane workspace
Open up to four documents side by side in resizable panes. Drag a tab to any edge to split the view, or into the center to move it — each pane keeps its own navigation, zoom, and search state.
Tabs that stay put
Pin the document you are working from and keep browsing the file tree without losing it. Tabs reorder by drag, close with a middle-click, and come back exactly as they were — per user, across reloads.
Saved tab groups
Save a session as a named, color-coded group — up to 20 groups of 25 documents — and reopen the whole set later, on any computer. Groups sync to your account; the pane layout stays local to the browser.
Precision navigation
Virtualized thumbnails with click-to-jump, direct page input, arrow keys, and overlay scrollbars — in single-page or continuous scroll mode. Press ? for the full keyboard reference.
Zoom from 5% to 1000%
Cursor-focal Ctrl+wheel zoom, fit-width and fit-page presets, and ±90° rotation — 5%–1000% in single-page mode, 25%–400% in continuous. Zoom, rotation, and view mode are remembered per document.
Selectable text layer
Toggle a real text layer over the sealed page to select and copy passages with formatting — or copy the whole page in one click. Pages without embedded text say so instead of failing silently.
Discovery
Search that finds the page, not just the file
Full-text search reaches inside indexed documents and takes you straight to the match — permission-aware, with page-level snippets.
One palette, two modes
Ctrl+K opens the command palette: search filenames and folders, or switch to full-text mode to search inside document content across the repository. Two characters is enough; results respect your permissions.
Find inside the document
A floating, draggable find bar searches the open document as you type — sort hits by relevance or page, jump with Enter, and read the snippet before you go.
Page-level precision
Results show the exact page number and a highlighted snippet. Click a hit and the document opens directly at that page.
Filtered and permission-aware
Narrow by type — folders, PDFs, Word, Excel, presentations, images, text, archives. Hits you are not allowed to read are silently excluded.
Ctrl+K · search “force majeure clause”
Master_Agreement_2026.pdf p. 14 — “…neither party shall be liable for any force majeure event as defined in…”
Working with files
A real file system, within your permissions
The VFS behaves like the shared drive your team already knows — except every action is governed by Shield policy, down to the folder.
Browse at scale
Virtualized folder lists stay fluid in directories with thousands of entries, with breadcrumbs and human-readable sizes — and the next folder preloads as you hover.
Uploads that survive the network
Drop files or an entire folder — the uploader scans it and shows a preflight summary. Files from 80 MB up stream in 20 MB chunks, three at a time, with pause, resume, and retry; collisions resolve by keep-both, replace, or skip.
Permission-aware interface
The UI reads your effective permissions per directory and only shows what you can do. Files you cannot read do not appear at all.
Downloads under policy
Select files and download a server-prepared ZIP — permission-checked file by file, resumable after a dropped connection, and capped only by policy (4 GiB by default). Files you cannot read are listed as restricted, never silently included.
A recycle bin, not a cliff
Deleting is soft: an undo toast, then the recycle bin. Restore with collision-safe renaming or purge permanently — retention is set by the administrator, 30 days by default.
Self-service
Your account, your control
Security and preferences you manage yourself — no admin ticket required.
Self-service 2FA
Enroll any TOTP authenticator — Google, Microsoft, Authy — by scanning a QR code, verified with a live code before activation.
Trusted devices
Optionally skip the second factor on devices you trust, within the window your organization allows. Changing your password revokes them all.
Your workspace, your way
Light, dark, or system theme, view-mode defaults, and the interface language — English or Spanish — saved server-side and following you across devices.
See the pipeline in action
We will rasterize, watermark, and stream a live document inside your own environment.