Watermarks, evidence, retention, and legal hold
Interpret Vault protection honestly and operate high-impact controls safely.
Identity-watermarked preview
Vault preview does not return an ordinary presigned download URL. Images, PDFs and text are rendered with viewer identity, UTC time, and a random evidence identifier embedded into the returned bytes. Word documents and spreadsheets are shown as a reading copy (text, headings, lists, tables and cells as they display) with the same watermark; the exact layout, charts and formulas stay in the original. Unsupported types fail closed.
Where a guest may download, a PDF or image download carries the same watermark as the preview, and so does every PDF and image in a guest's ZIP. Other formats download as they are.
Review access evidence
Document open, page view, close, denied download, and print-attempt signals feed append-only evidence. Export includes NDA records, page events, chain fields, and a manifest hash. These are application events, not proof that the recipient understood every visible page.
Apply or release legal hold
Legal hold blocks policy/content changes and deletion for protected copies. The action requires security permission and recent step-up verification. Release only under an approved legal process; governance/compliance retention may continue to block deletion after hold release.
