Embed sensitive-file protection into an AI workflow without giving the agent a permanent key. A human defines the policy, Cloak File protects the data, Cloak KMS controls the permitted key operation, and a signed receipt records the result.
Especially when a production launch or enterprise security review needs answers.
Bind file and key operations to the correct customer boundary.
Expire or revoke a credential without rotating a raw key out of agent prompts or code.
Return a signed receipt so another system can verify the recorded operation.
Encryption without changing your workflow. It fits around the tools you already use.
Right-click any file in Windows Explorer, Finder, or your mobile file picker. Or drag into the Cloak desktop app. Any file type — PDF, Excel, Word, image, archive.
Choose who can open the file (by email), what they can do (read-only, download, print), and for how long. Policies are enforced by Cloak's key server — not by the file itself.
The encrypted file is safe to send via email, Dropbox, USB, or any channel. Keys never travel with the file. Recipients need the Cloak app to open it.
Every encrypt, decrypt, share, and revoke operation returns a signed JSON receipt. Collect them for your audit trail. Verify any receipt at verify.cloakapps.com — no login needed.
Change your mind? Revoke access to a file from the console or via API. The recipient's Cloak app will deny the next open — even if they already have the encrypted file on their machine.
The console shows every file operation: who encrypted what, when each recipient opened it, and any access denials. Filter by client matter, date range, or file type.
No shared password to remember or lose. Keys are managed by Cloak's key server and tied to identity. Lose your device — not your files.
Every operation returns a receipt signed with Cloak's ECDSA private key. Verifiable offline. Present in a regulatory review or dispute without calling Cloak.
Revoke a file's decryption key from the console at any time. The next open attempt fails — on any device, anywhere. No need to retrieve the file.
Set an expiry date on any file policy. Access auto-revokes at midnight on the last day — no manual action required. Useful for draft deliverables and time-sensitive disclosures.
The console shows a full operation log per file, per user, and per client matter. Export as CSV or JSON for PDPA, GDPR, or internal audit.
Automate file protection in your existing workflows. Or wire it to an AI agent via MCP — protect files autonomously with human-authorized policies. No SDK lock-in.
The protected-file integration is designed for MCP-compatible agents and application workflows. The human administrator grants the scope first; the agent receives an operation result and receipt, not the underlying private key.
Policies are human-authorized upfront. The agent operates within the policy boundary and cannot escalate its own permissions. Every agent action appears in the same audit log as human actions.
protect_file — encrypt with policydecrypt_file — retrieve plaintextcreate_receipt — generate signed audit receiptverify_receipt — confirm receipt authenticityrevoke_access — remote revoke by key reference# Agent calls protect_file via MCP result = mcp.call_tool( "protect_file", { "file_path": "./client_financials.xlsx", "policy": { "recipients": ["alice@firm.com"], "permissions": "read-only", "expires_at": "2025-12-31" } } ) # Every call returns a signed receipt receipt = result["receipt"] # → { operation, actor, file_hash, # key_ref, timestamp, signature }
Encrypt and open protected files in the browser, on Android, and on iOS. Desktop apps (Windows / macOS) are coming soon.
All apps are free to download. A paid account is required to encrypt files.
Cloak Files does not store file keys next to the file, in the app, or in the agent. Each protect and each open is a scoped key operation performed by Cloak KMS inside the configured key boundary — a SoftHSM software token in the sandbox, or a hardware HSM in BYO and hosted custody paths.
The per-file encryption key is wrapped for each recipient using their account masterkey — ECDH key derivation for ECC identities, RSA-OAEP for RSA. The masterkey itself stays inside the KMS boundary.
Opening a protected file requires a fresh unwrap by KMS under the recipient's identity and the file's policy. No standing key travels with the file — which is what makes remote revoke real, not best-effort.
Agents get the same KMS-scoped, TTL-limited, revocable credentials that back the file tools. Revoking the credential or the key stops the agent — no key rotation out of prompts or code.
In hardware custody paths, the masterkey that wraps your file keys is generated inside a PKCS#11 HSM — smartcard HSM, YubiHSM 2, AWS CloudHSM, or a customer-controlled device — and is non-exportable by design. Wrap, unwrap, and signing run inside the device; Cloak Files only ever sees the operation result.
Start in the SoftHSM software sandbox, then move regulated file keys to managed hardware (capacity-limited) or your own HSM after a compatibility assessment. The file workflow, API, and MCP tools stay the same.
Explore Cloak KMS custody paths →Evaluate with software keys. Use the Managed Key Custody for production. Connect customer-controlled hardware when ownership of the root trust is a requirement.
See plans and custody paths →Free account. 50 file operations included. No credit card. Full API and MCP access from day one.
Create free account →Preview: the 15-minute protected-file quickstart — agent encrypts, you open it in the browser, receipt verified.
Governed by the OMMAU Charter — humans authorize, agents execute, receipts record supported actions.