On this phone
Your file stays where it already is, so you don't end up with two of everything. It's sealed the moment you send it. Before that, it's as safe as your phone is, so if your phone is locked, so is your file.
Files
Your files stay on your phone.
Not on our servers. Not in a folder we could open if somebody asked us nicely. You add a file, you organise it, and when you send it to someone it travels sealed the whole way. The server holds the sealed blob until the person you sent it to collects it, and clears it after thirty days whether they did or not. It cannot open it at any point, and that copy is the only one in between.
On Android now, and on iPhone in the TestFlight beta. Files shipped on Android in 0.11 and has its own place in the bar. The iPhone build carries it too and is installable as a TestFlight beta, which is a beta rather than the App Store.
Two ways to keep something
Because "private" means different things for different files.
A holiday photo and a signed contract don't need the same care, so you get to choose. Here's what each one gives you.
Encrypted
A locked copy inside the app, opened only by your passphrase. Someone holding your phone gets nothing readable. This is the one for the documents you'd mind losing, and you can move a file into it at any point, without hunting for it again.
You decide which
Most things don't need locking away, and pretending otherwise just fills your phone up. Add everything the light way, then encrypt the few that matter, one swipe, and the app tells you plainly that you'll then have two copies until you tidy up the original.
Labels
Every file says how sensitive it is.
A list of filenames tells you nothing about what you're about to send. Every file here carries a marking, how confidential it is, and which part of the business it belongs to, and it stays with the file when it travels, so it arrives filed the same way rather than landing in a heap.
It's written, not just coloured
The level is spelled out on every row. Colour helps you scan, but it's never the only thing telling you, nobody should be deciding whether a document can leave the building by remembering what amber meant.
It travels with the file
Send something and its marking goes too, so it lands under the same heading on the other phone instead of quietly becoming ordinary. The person receiving it sees what you saw.
Your own words
Levels and areas are whatever your organisation already calls them. Nothing here assumes a government scale, and a level we haven't been given a name for is shown as itself rather than guessed at.
What a level does, and what it doesn't
A level decides who can open a file. It does not decide where a file can be put: if you can read something, nothing here stops you filing it somewhere less protected. Marking is a filing system with teeth on the reading side, not a guard against someone carrying material downward.
Sending
To a person, not to a link.
We used to make share links. They worked, and the server couldn't read them, but a link is a key anybody can forward, and it has no idea what it's carrying. So we took them out.
Now a file goes to someone you've chosen, through the same encrypted channel as your messages. Before it sends, the app tells you who will be able to open it, in those words. That sentence is deliberate: a marking says how careful to be, and handing someone the file is you deciding they're allowed. Nothing further down the line will second-guess it, so the moment you tap send is the moment that matters.
How to send a file only one person can open
- Keep the file in Files. It can stay "On this phone", or you can make a locked copy that only your passphrase opens ("Encrypt a copy").
- Open your chat with the person, tap the attach button, choose the file under "Send a file", and send it. On iPhone you can also swipe right on the file in Files and tap Send. The app says who will be able to open it before it goes.
- It travels sealed the whole way. The server holds the sealed copy until the other person collects it, and deletes it after thirty days whether they did or not. It cannot open the file at any point.
There is no account to make on any other service, no public link, and no phone number needed. One thing to know: a file is sent exactly as it is, including anything inside it, such as where a photo was taken.