Tokenized, time-limited share links
Generate a single-doc share URL with a TTL you control. Token hash stored, plaintext returned once. Revoke any time - revoke is instant.
Customer document share
Share your compliance docs with customers - without email attachments.
Customers visit a tokenized URL, see exactly the document you've shared, pull the latest version, and you keep an audit trail of every view and download.
Partial - see below
What ships today
Encrypted at rest, secure in transit
AES-256 SSE on every S3 write, enforced in code (not just bucket policy). TLS 1.2+ in transit. Per-tenant CMK on Enterprise.
View + download audit trail
Every customer view and download writes to the append-only audit log: timestamp, IP, version. Defends against "we never received it".
View limit + expiry
Set max_views per share; link silently stops working when hit. Same for expiry. Customer sees a clean expired page, you see the access history.
No login for the customer
Public viewer at /share/<token>. Same tokenization primitive as the supplier-inbound flow - single-use or N-use, your call.
Automated email + standing folder access
Today the staffer copies the URL into their email client. Auto-send-on-create, one-click resend, and per-customer folder-scoped standing access are next when a customer asks.
How it will work
- 01
Build the share
In the Tracegence app, pick a customer. Pick the documents (or a folder). Set TTL. Click Generate.
POST /customer-shares (planned) - 02
Send the link
Email the URL to your customer contact, or pipe it through your CRM. Token is hashed in DB, plaintext returned once.
/c/<token> - 03
Customer opens
They land on a clean, tokenized page. Your branding, your latest documents. No login.
GET /public/customer-share/<token> - 04
Customer downloads
Pre-signed S3 URL with a short TTL. Each download writes an audit-log row with the customer email and the document version.
pre-signed S3 URL - 05
Auto-rollforward
You upload v2 of the CoA. The customer's next visit shows v2; v1 stays available with a "previous version" badge.
apps/files/services.py - 06
Expire / revoke
Token TTL hits or you revoke. The link silently stops working. Customer is notified if they try to access.
POST /customer-shares/<id>/revoke
What's next
Dates are targets, not commitments. Design partners get earlier access.
Q2 2026
- Auto-send email on share creation (templated, with the public URL)
- One-click resend if the customer missed the original
- Per-customer standing folder access (instead of one share per doc)
Q3 2026
- Customer-side notification when a shared doc rolls to a new version
- Webhook parity for ERP integration
- Per-tenant branded share viewer (logo, colour scheme)
Help us prioritise this.
If your customers ask for compliance docs over email more than once a month, we'd like to learn what their workflow looks like.