Cloak Vault · Document DRM and access policy

Control your documents
after you send them.

Cloak Vault applies DRM policy to any document — read-only, no-download, no-print, time-limited. Policies are enforced server-side, not by the file. Revoke access remotely, any time, even after the recipient has a copy.

Server-enforced policy Remote revoke any time Every view is logged
Vault — Document Policy
Protected document
Due_Diligence_Report_Q2.pdf
Protected · 2.4 MB
Access policy
Read only No download No print Expires 2025-09-30
Recipients
buyer@investco.com Opened · 3 times
legal@investco.com Not yet opened

Stop losing control of sensitive documents

Once you email a file, you've lost control — unless you sent it through Vault.

Due diligence data rooms

Share financial models, due diligence packs, and confidential business plans with buyers under read-only policy. Auto-revoke when the deal closes or collapses. Know exactly who read what and when.

Client report delivery

Deliver consultant reports, legal opinions, and strategy documents to clients without them forwarding to competitors. Read-only policy means they see the content but can't extract it.

Regulatory disclosures

Share audit-required documents with regulators or external auditors under strict time limits. The access log is your compliance evidence — every open, every denial, timestamped and signed.

IP-sensitive creative work

Designers and agencies can share unreleased assets with clients for review without the work leaking. No-download, watermarked preview mode keeps your IP under control through the approval cycle.

Board and executive packs

Distribute board packs with market-sensitive information. Auto-revoke after the meeting. Log which directors accessed materials before the meeting — useful for insider trading governance.

Automated via API

Protect documents programmatically from your CRM or AI agent. The Vault API accepts any file type and returns a policy-wrapped version plus a receipt in a single call.

Server-enforced — not file-enforced

Traditional DRM bakes restrictions into the file. Vault enforces policy server-side — so it works even after the file has been forwarded, downloaded, or copied.

Traditional file-level DRM
  • Restrictions embedded in file — can be stripped
  • No way to revoke after delivery
  • No view log — you can't see who opened it
  • Forwarding bypasses all restrictions
Cloak Vault server-enforced DRM
  • Policy lives on server — impossible to strip from the file
  • Remote revoke at any time — even after forwarding
  • Full view log — who, when, which device
  • Forwarding is irrelevant — key stays on server

Simple Vault pricing

Protect up to 100 documents free. Upgrade when your team needs more.

Team
$19/mo

5 users · 100 protected docs

  • Read-only + no-download policy
  • View log + remote revoke
  • Email + link sharing
Get started →
Recommended
Business
$49/mo

Unlimited users · unlimited docs · API access

  • Everything in Team
  • REST API + MCP tools
  • CSV / JSON export for compliance
  • Priority support
Get started →
View full pricing including bundles →

Take back control of your documents

Free account. 100 protected documents included. No credit card.

Create free account →

Governed by the OMMAU Charter — humans authorize, agents execute, receipts prove it.