Keep content zero-knowledge
Encrypt in the browser so the storage and API layers receive ciphertext without the link-mode decryption key.
Vianordis--:--:-- UTCVianordis / ED. 02 / 2026
§ 07 — App support
Viaport
Share sensitive files without giving the platform the keys.
Viaport encrypts files and metadata with AES-256-GCM in the browser, keeps link-mode keys in a URL fragment that HTTP never sends to the server, and gives teams enforceable expiry, one-time download, quota, and deletion controls.
01 — Problem
Most file-transfer services can read the documents they promise to protect.
Teams regularly send contracts, financial records, employee documents, customer exports, and other sensitive files outside their normal workspace. Conventional sharing encrypts transport and storage but leaves the service holding the keys, filenames, previews, or long-lived copies.
- The transfer provider can often decrypt or inspect uploaded content and metadata.
- Email attachments create uncontrolled copies with no reliable expiry or download boundary.
- External recipients are forced to create accounts for a one-time exchange.
- Shared files remain available after the business purpose has ended.
- Operators collect more recipient activity data than is necessary to enforce the transfer.
02 — Solution
Viaport moves the trust boundary into the sender's and recipient's browsers.
The sender's browser creates a random 256-bit key, encrypts file chunks and metadata with authenticated encryption, and uploads only ciphertext. For ordinary link shares, the key is placed after # in the URL, so it is available to the recipient browser but absent from HTTP requests and server storage.
- Authenticated users create encrypted transfers without uploading a plaintext filename, MIME type, or file body.
- Recipients download the opaque object through a public link and decrypt it locally with the fragment key.
- The backend enforces expiry, download limits, one-time claims, storage quota, manual deletion, and privacy-preserving download records.
03 — Benefits
Keep transfer convenience while removing the platform from the plaintext path.
Viaport gives users a straightforward link-sharing workflow while reducing how much sensitive information the service must be trusted to handle.
Hide meaningful metadata
Encrypt the filename, MIME type, and original file size alongside the content instead of exposing them to the backend.
Share outside the organization
Let recipients download and decrypt through the browser without requiring an account for a one-time transfer.
Reduce stale exposure
Set a short expiry, enforce a maximum download count, or atomically consume a share on its first download.
Keep sender control
Use the authenticated dashboard or a dedicated deletion token to remove a share before its scheduled expiry.
Minimize activity records
Track download counts while storing salted hashes of IP addresses and user agents instead of their raw values.
04 — How it works
From local file to recipient download in three steps.
- 01
Choose the lifecycle
The authenticated sender selects a file, expiry period, maximum download count, and optional delete-after-download behavior.
- 02
Encrypt before upload
WebCrypto generates a random AES-256 key and encrypts file chunks plus metadata locally before Viaport receives the opaque blob.
- 03
Share and decrypt
The recipient opens the complete URL, downloads ciphertext, and decrypts it in the browser using the key carried only in the fragment.
05 — Features
What senders and recipients can actually do in Viaport.
Chunked browser encryption
Encrypt files in one-megabyte chunks with AES-256-GCM and a unique derived IV per chunk to limit browser memory pressure.
Encrypted metadata
Protect filename, MIME type, and original size separately so the recipient can inspect details only after local decryption.
Zero-account receiving
Open the public download page, validate the fragment key, decrypt metadata, stream the encrypted object, and save plaintext locally.
Transfer lifecycle controls
Choose one- to thirty-day expiry, set an optional download ceiling, enable delete after first download, or delete manually.
Sender dashboard and quota
Review active encrypted objects, expiry, one-time status, download counts, storage usage, and assigned quota through Keycloak SSO.
Recipient-keyed API mode
Seal a data key to an X25519 recipient public key for a short-lived, one-time, device-specific transfer without a URL fragment.
06 — Architecture
Architecture and zero-knowledge boundary.
Viaport deliberately separates plaintext cryptography in the browser from lifecycle enforcement and opaque storage on the server.
- A React and Vite frontend uses the WebCrypto API to generate AES-256 keys and encrypt file chunks and metadata before upload.
- Link-mode keys are encoded in the URL fragment, which is processed by the recipient browser and is not included in HTTP requests.
- A Go Fiber API validates Keycloak OIDC tokens for upload, dashboard, quota, and owner deletion routes while keeping recipient download routes public.
- PostgreSQL stores user quota, opaque file identifiers, encrypted size, encrypted metadata, expiry, limits, deletion-token hashes, and privacy-preserving download logs.
- S3-compatible storage such as Ceph RGW holds application/octet-stream ciphertext under non-semantic owner and date paths.
- Scheduled cleanup removes expired objects and download logs, while atomic database updates enforce quota, maximum downloads, and one-time claims across instances.
- The PQXDH recipient primitive can seal a file key to an X25519 public key for short-lived device-pairing transfers.
07 — Use cases
Where Viaport fits.
Contracts and legal documents
Send agreements, evidence, and privileged material through a short-lived link without exposing the document or filename to the transfer platform.
Finance and executive exchange
Transfer forecasts, board packs, transaction documents, and account records with a fixed download ceiling and expiry.
HR and employee records
Deliver employment documents or personal records through an encrypted link that is atomically consumed when its one-time download is claimed.
Customer and partner delivery
Share exports, deliverables, and large attachments with external parties who should not need another account.
Security-sensitive handoff
Move incident artifacts, configuration packages, or confidential reports while keeping meaningful file metadata out of server storage.
Device bootstrap
Use recipient-keyed mode to seal a short-lived, one-time transfer to the public key of the device being paired.
08 — Integrations
Built on standard browser, identity, storage, and deployment interfaces.
Viaport does not require a proprietary desktop client or a specific public-cloud storage vendor.
WebCrypto API
Lets approved systems connect without ad hoc exports or manual copy-paste.
Keycloak / OIDC
Keeps access tied to organization accounts, roles, and sign-in policy.
React
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Vite
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Go Fiber
Shows how this service fits into the wider Vianordis environment instead of standing alone.
PostgreSQL
Stores structured service records in a controlled tenant-aware backend.
S3-compatible storage
Provides the governed place where service data and files are stored.
Ceph RGW
Provides the governed place where service data and files are stored.
PQXDH recipient sealing
Shows how this service fits into the wider Vianordis environment instead of standing alone.
REST API
Lets approved systems connect without ad hoc exports or manual copy-paste.
Docker
Shows how this service fits into the wider Vianordis environment instead of standing alone.
Kubernetes
Shows how this service fits into the wider Vianordis environment instead of standing alone.
09 — Trust
Security, privacy, and control signals.
Viaport reduces platform knowledge by design, but the complete share link remains a bearer secret. Teams should protect the fragment key with the same care as the file itself.
Key isolation
The link-mode AES key is generated in the sender browser and carried after #, so normal HTTP requests and backend records do not contain it.
Authenticated encryption
AES-256-GCM protects each file chunk and its encrypted metadata with integrity verification during recipient-side decryption.
Minimal metadata
The backend sees opaque IDs, encrypted blob size, encrypted metadata, lifecycle state, owner, and counts—not the plaintext filename, MIME type, or content.
Atomic lifecycle limits
Database updates reserve quota, enforce maximum downloads, and claim delete-after-download shares before streaming to prevent concurrent bypass.
Privacy-aware logging
Download records retain timestamps and salted truncated hashes of IP and user-agent values, with scheduled log expiry.
Abuse resistance
Public file routes use per-IP and per-file rate limits; password-capable API shares add cross-instance brute-force lockouts.
10 — Pricing
Use published pricing or review your external-transfer workflow in a demo.
Viaport is listed at €13 per user per month on the Vianordis rate card and is included in the Essentials bundle. A demo can cover upload limits, quota, expiry policy, recipient workflow, storage integration, and deployment requirements.
11 — FAQ
Questions technical buyers usually ask.
What does zero-knowledge mean in Viaport?
The browser encrypts file content and metadata before upload. In link mode, the decryption key stays in the URL fragment, which the browser does not send to the server, so the platform stores ciphertext without the key required to open it.
What information can the server see?
The server sees the sender account, opaque file ID, encrypted blob size, encrypted metadata, creation and expiry times, lifecycle settings, and download count. It does not receive the plaintext content, filename, MIME type, original size, or link-mode key.
Does a recipient need a Viaport account?
No for ordinary link shares. Upload and sender-dashboard access require organization sign-in, while the recipient download route is public and decrypts locally from the complete URL.
What if someone obtains the complete share link?
The complete URL is a bearer secret: anyone who has both the file ID and fragment key can attempt to download and decrypt the file while it remains available. Use an approved channel, short expiry, and one-time or limited downloads for sensitive material.
What happens when a share expires?
Metadata and download endpoints reject an expired share immediately. An hourly cleanup process soft-deletes the database record, removes the encrypted object from storage, and releases the sender's quota.
Can Viaport recover a lost decryption key?
No. The backend does not store link-mode plaintext keys. The sender dashboard can rebuild a complete link only while that browser still has the key fragment in local storage; otherwise the sender must create a new transfer.
Is Viaport certified against a specific compliance framework?
No certification is claimed. Viaport provides technical controls for client-side encryption, key isolation, lifecycle enforcement, identity, quota, and privacy-aware logging; customers must assess those controls against their own obligations.
12 — Next step
Move sensitive files without moving plaintext trust to the transfer provider.
See how Viaport can give employees a simple encrypted-link workflow while keeping file content, meaningful metadata, and link-mode keys outside the server boundary.