Share sensitive documents
without losing control.

Yes. Create named vaults (workspaces) under one account. One password derives keys for all your vaults. Documents, team delegates, and audit trails stay isolated per vault.

1Bridge Vault is designed for Beneficial Owners & Controllers who personally handle document requests from Regulated Firms. You own the vault and control all access. Optionally, you can delegate to team members (like ops or legal) who can create share requests and manage workflows, but they never see your documents, encryption keys, or vendor secrets. Only you can approve shares and generate the cryptographic material needed for vendor access.

No. Delegates (team members) can create share requests and manage sharing workflows, but they never have access to your documents, encryption keys, or vendor secrets. They work with metadata only. Only you, as the vault owner, can approve share requests and generate the cryptographic material needed for vendor access.

There is no password recovery. Your vault password is never transmitted to our servers; it is used locally to derive your encryption keys. If you lose it, your documents cannot be recovered. This is a deliberate security choice: it means even we cannot access your documents under any circumstances. We recommend using a password manager.

Vendors must complete a three-step verification: (1) They receive a share link, (2) They verify their email address via a one-time passcode (OTP), and (3) They enter a one-time vendor secret that was sent directly to them. Only after all three factors are verified can they view documents.

Yes, and every download is tracked and watermarked with the vendor's details, timestamp, and a unique reference ID that appears in your audit log. Watermarks are single-use and can always be traced back to the vendor that first accessed the document. Images and PDFs both receive visible and invisible watermarks. Each watermark includes a verification link you can check at any time.

No watermarking system is foolproof. Determined users can screenshot documents or attempt to remove watermarks with image editing tools. However, watermarking creates a strong deterrent and provides accountability through the audit trail. Each watermark is unique and single-use, meaning if a document is shared without authorization (even via screenshot), it can always be traced back to the vendor that first accessed it. The audit log records every view and download with unique reference IDs, regardless of whether the watermark is later removed.

Yes. You can create signing requests for PDFs, place signature fields, and collect vendor signatures with recorded electronic consent. In dual-signing mode, the owner counter-signs after the vendor. The fully executed PDF is watermarked, hash-chained, and when the owner finalizes, anchored to Bitcoin via OpenTimestamps with a downloadable verification certificate.

When an owner counter-signs a contract (dual-signing mode), 1Bridge computes the SHA-256 hash of the final watermarked PDF and anchors it to the Bitcoin blockchain using OpenTimestamps. Anyone can verify the document independently at /verify without trusting 1Bridge. Vendor-only signing completes the contract but does not trigger blockchain attestation.

The vault supports identity documents (passport, national ID, driver's license), proof of address, source-of-funds and source-of-wealth materials, ownership evidence, company records, director and signatory documents, and PDF contracts for signing. These are the documents most commonly requested by Regulated Firms during onboarding, diligence, banking, legal, audit, and transaction workflows.

Yes. You or your delegates can revoke any share link instantly. Once revoked, the vendor's access stops immediately, even if they still have the link and vendor secret. Revocation is logged in your audit trail.

Documents are encrypted with AES-256-GCM. Your vault password derives a KEK using Argon2id, and the KEK encrypts your vault's private key. Each document gets its own random encryption key (DEK), sealed to your vault's public key rather than wrapped with the KEK, so only the private key can open it once the vault is open. Share links use HKDF-SHA256 to derive wrapping keys from one-time vendor secrets.

No. 1Bridge is a controlled document-sharing layer, not a KYC, AML, DMS, CRM, or compliance system. It helps Beneficial Owners & Controllers share sensitive documents with your team more safely, complementing the systems you already use for onboarding and diligence.

Yes. Send a document request link to anyone: a counterparty, a family member, or a business partner. They verify their email with a one-time passcode, then upload files that are encrypted in their own browser before they leave it. Each file is sealed to your vault's public key, so only you can open what arrives. The counterparty never creates an account and never sees your other documents.