Access and sharing

A company member reads the data room through the circles they belong to. A circle names readableCategories, an array of codes. F includes all finance children, including ones added later. FS grants financial statements alone. Belonging to several circles combines them; there are no deny overrides. A circle grants reading. Company administration and document editing are separate permissions. Filing eligibility does not limit a circle's scope: both parent and intermediate codes can appear in one.

A category without children can hold documents. A category with children groups their documents and remains a valid scope.

A circle is also a shared folder and a shared memory on the company host. Its id is the lowercase English name the host uses for both, such as leadership, and never changes. The product names its default circles in every language; a circle the company makes has one display name of its own. Every new member joins member; administrators created with a company also join leadership. Later changes to administrator status change no circle. Settings → Company places each member in circles and edits what each circle reads.

A circle can also have a private channel on the company messenger. An administrator turns it on in the circle's settings and names it, and the company host opens it as the agent. Its members are the circle's active members: placing someone in the circle adds them and taking them out removes them, at the moment of the change, and a pass every two minutes takes back anyone added in the channel by hand. The app offers nobody a way to add, remove or leave from inside the channel. Turning it off deletes the channel, once its exact name is typed.

Editing a circle immediately changes what its members and every share of it can read. Adding a child immediately extends existing parent scopes. Review those readers before changing either. Category codes and ancestry are stable.

Sharing outside the company

An administrator lends what one circle reads to an external email or an explicitly public audience, and sends an email recipient the invitation. The recipient must accept it with that verified email and gains no company membership, circle or host filesystem identity. An expired or revoked share stops new reads. Original file downloads require canDownload; text previews follow read access. A downloaded copy cannot be recalled, and issued file links expire within ten minutes.

A PDF a guest downloads is stamped on every page with the recipient's email, or the link's identifier, and the time in UTC. A PDF that cannot be stamped is not downloaded. While a guest reads, the viewer overlays their email or the link's name and the time the room was opened.

Publication requires an explicit public share. It never publishes X.

Code-protected links

An active member creates a link by choosing a circle within their own access. Every circle is eligible, including leadership; X follows the same circle and creator permissions. Its default lifetime is three days; the available lifetimes are defined by dataRoomLinkLifetimeHours. The database enforces a seven-day ceiling.

The app generates a six digit code, displays it once and stores its salted password hash. The recipient enters the code and acknowledges the versioned confidentiality notice. This creates a guest session for up to one hour, bounded by the link's expiration, without creating a company member. Ten code attempts per network address in fifteen minutes temporarily lock further attempts. A link also has a shared ceiling of one hundred attempts per window.

Every database read checks the link, what its circle reads now and the creator's current access. Widening the circle cannot exceed the creator's access. The creator or a company administrator can revoke a link. An open page loses further access and clears its displayed documents on its next session check. Original download URLs expire within one minute. Already downloaded files cannot be recalled.

The confidentiality acknowledgment records its notice version and time; any separate confidentiality agreement remains the company's responsibility.

Moving a document into another category changes its readers.