Access Controls

Encryption isn't enough on its own

End-to-end encryption means we can't read what's shared or submitted. But a link without access controls can still be opened by anyone who receives it, intended recipient or not.

The same is true in both directions: a share someone can open, and a request someone can fill. Access controls are the layer between "encrypted and stored" and "actually secure for this specific situation."

Email OTP verification

They enter their email address and receive a one-time code. They verify it before a share is decrypted, or before they can open and fill a request. This ties access to a specific identity, not just anyone who has the URL.

Good for: credential handoffs to a named person, client intake forms, any share or request where you know exactly who should open it.

Passcode protection

Add a 6-character passcode that must be entered separately from the link. You share the code through a different channel.

The logic: if the link is intercepted, the attacker still needs the passcode. Two factors across two channels, whether they're revealing a share or opening an intake.

Good for: high-sensitivity handoffs, client intake you want gated, sharing within teams where you want belt-and-suspenders protection.

Allow and deny lists

Restrict access by email address or domain. An allow list opens the share or request only to those addresses or domains (up to 20 entries). A deny list blocks specific addresses or domains.

Good for: team-internal shares, client-specific forms, blocking access from known problematic addresses.

View limits

Set a maximum number of times a share or a received submission can be opened — between 1 and 100. Access stops automatically after the limit is reached.

A view limit of 1 creates true one-time access: used once, then gone.

Good for: any handoff or intake where you want the secret viewed exactly once, and no more.

Expiration dates

Set a hard deadline. After that date and time, the share link, request link, or submission stops being accessible — regardless of how many times it was accessed.

Good for: time-sensitive credentials, temporary intake windows, anything that shouldn't remain accessible indefinitely.

Layering controls

These controls work independently and can be combined. Some examples:

• One-time handoff to a specific person: email OTP + 1 view limit
• Team-only access: domain allow list + expiration
• Vendor intake: email OTP + expiration date
• Client-only request: allow list + email OTP + expiration

You only need the controls that fit the situation. A share to a trusted colleague isn't the same as a client intake form, so pick accordingly.