Client documents: where files live, who can open them, how they're encrypted

On the client's page

Documents: a list with type, upload date, who uploaded, and size. Types are a short fixed list — ID, contract, proof of billing, correspondence, other — so you can find "the ID" across a hundred clients. Upload from a phone camera or a file. Open streams the decrypted file for that request; Delete moves it to Recently deleted for thirty days.

Who can open

Owners and admins open and delete. Managers open. Receptionists see that a document exists and its type, not its contents — enough to say "yes, we have your ID on file". Staff and supervisors see nothing. The tenant opens their own documents from the portal, which is where their signed lease lives too.

The encryption, plainly

Each workspace has a file key generated at setup. Every upload is encrypted with it before being written; the plain bytes are never stored. Opening decrypts into memory for that one response. The key lives on the server outside the web root and in the offline copy the setup page asked you to keep. Without the key, the files are noise — to an attacker with the disk, and to us.

What is logged

Upload, open, delete — each with who, when, which document, which client. Opening is the one people forget is logged; it is there so that "who looked at this tenant's ID" has an answer.