Pillar 1

Policy Controls

Every share link is a runtime policy decision — expiry, view limits, watermarking, and revocation enforced on every single request, with zero cache windows.

What you get

  • Immediate revocation — next request returns 403, no stale cache
  • Atomic view-count decrement prevents race-condition overuse
  • Watermarks baked into rendered output, not overlaid client-side
  • Passcode and email OTP gates verified server-side before any content renders
  • License-aware enforcement with observe mode for rollout safety

How it works

  1. 1
    Define constraints

    Set expiry, view limits, download permissions, watermark, passcode, and OTP on a per-share basis.

  2. 2
    Enforce at runtime

    Every page request evaluates the full policy stack. A single failing constraint blocks the entire response.

  3. 3
    Log + prove

    Policy state at evaluation time is captured in the audit trail — not just the outcome, but which constraints were active.

Technical detail