Sensitive distribution and personal documents

Access boundary: Current capability and authority required.

Implemented candidate with migrations 0055–0059 and separate deterministic strong/verified_account qualification. Default strong, explicitly selected verified_account, aligned environment/D1 policy and human approval remain mandatory; real Auth0, provider delivery, publication and external-client proof are separate.

Surfaces: Workspace and personal web UI in FR/EN/DE/LB; workspace REST/MCP and assistant packages under scopes. Recipient access and sensitive approval are browser-only; workspace Bearer tokens cannot open the personal vault. Native and real host support need surface-specific qualification.

Read the engineering guide · All features

Capabilities

One Guteneo account receives, keeps documents and uses services, with zero workspaces permitted
Prepare a verified PDF for one named recipient; immutable permissions, term, tax-exclusive price and notification language; revoke unexpired legacy draft/active hosting first, and use a dedicated source after any referenced postal derivation, legacy send, postal preflight or provider draft
Bounded durable private rendering serves authorized page images and accessible text; the reader never delivers the original PDF
Shared terms of 7/30/90/365 days and personal-copy terms of 365/1095 days; personal-copy options are funded at activation even when unused
Versioned prices and separate invitation transport; activated retention commitments are nonrefundable even after revocation
Review final pages/text, recipient, message, permissions and quote before browser approval under the active policy; email-request attestation remains separate
Atomic activation and outbox insertion require sensitive browser evidence even through REST/MCP confirmation; expert delegation cannot approve this flow
Opaque invitation moves through same-tab handoff and a POST exchange, never authentication returnTo, logs, MCP responses or public captures
Individual association requires a verified address, stable-account request and independent workspace confirmation; pending association exposes no sensitive title
My documents separates Shared with me and Saved copies, with bounded server filtering/search and pagination over authorized documents
Private pages and text load on demand; document policy, recent session and current grant are rechecked before each delivery
Paginated workspace audit distinguishes server/browser provenance and actor account without claiming physical identity; detailed access events retain ninety days, immutable receipts remain separate, visible refresh is bounded and no full reading, disk save or screenshot is proven
Optional original export is explicit and requires five-minute authentication freshness under the current policy; requested download and started transfer are distinct events
Idempotent personal deposit uses bounded durable jobs, visible automatic progress and recovery after tab closure; success appears only after activation
Acquired copies survive workspace revocation or departure; personal export/deletion/history are private from the sender; cancelling deletion retains the copy, confirming removes reading/export, and deletion/expiry prevents redeposit through the same invitation without an extra charge
Services remain available through the same account, with voluntary workspace choice/creation, no mandatory purchase and no confidential-content targeting
Existing REST/MCP and assistant packages expose catalog, preparation, listing, detail, confirmation after browser evidence and revocation under current rights/scopes
Workspace tools expose neither personal principal, recipient association nor personal-vault content
Activation fails closed until keys, renderer, scanner, provider and aligned document policy are qualified; V1 excludes ordinary attachments, legacy postal transformations, cropping, analysis and password access after sensitive reference, even after failure/revocation; only a dedicated invitation without source attachment is eligible, with bidirectional service/SQL race guards; local email flags and dated provider qualification prove no installed quota policy, signed webhook or delivery
Secure distribution navigation follows Documents while Overview and Assistants lead; list/preparation/detail retain a coherent title and active entry; document-policy, assurance, freshness or approval refusal offers voluntary Check my access for fresh sign-in and a secret-free list return, without SSO loops or automatic approval
Workspace preparation explicitly paginates PDF sources and explains that an authorized personal copy can be exported even when the shared original cannot
Association attestation binds the displayed account, address and request; changing the candidate requires new independent verification
Personal-list 401/403 clears loaded metadata and cursors; stale pagination responses cannot restore an old list after refresh

REST operations

GET /api/secure-distributions
POST /api/secure-distributions
GET /api/secure-distributions/catalog
GET /api/secure-distributions/{id}
POST /api/secure-distributions/{id}/confirm
POST /api/secure-distributions/{id}/revoke

Read the REST integration guide for authentication, errors and contract discovery.

MCP tools

confirm_secure_distribution
get_secure_distribution
list_secure_distributions
prepare_secure_distribution
revoke_secure_distribution

Read the MCP integration guide for scope, approval and host boundaries.