What’s yours is yours.

What’s shared should be yours to control. SuperFile wraps any file — PDFs, spreadsheets, presentations, videos, drawings and maps — in key-separated encryption your organization controls for life. Share with confidence, see exactly who has opened it, and revoke access at any time, even for copies already downloaded to a laptop or an external drive.

A regular file vs. a SuperFile.

Usually when a file leaves your hands, it's out of your control. With SuperFile, you stay in control for the entire life of the file.

report.pdf Regular file
  • Anyone it reaches can open it — forever
  • Every forward and copy escapes your reach
  • No idea who opened it, or where
  • You can't pull it back once it's out
  • A stolen copy opens like the original
  • Screenshots and screen recordings copy it freely
report.pdfs SuperFile
  • Only the people, teams and devices you name can open it
  • Access is checked live on every open, and every 6 seconds while it is open
  • Every open is logged — who, from where, when, and who was refused
  • Revoke in one click: web viewers go dark in about 300 ms, the Mac viewer within 6 seconds
  • A stolen copy is ciphertext — the key never travels with the file
  • Screenshots black on Mac and Windows hardware viewers; refused elsewhere

Three powers baked into every file.

Encryption in the file, access and revocation in the key service — enforced on every open, wherever the file goes, for as long as it exists.

01

Encrypt

Key-separated encryption seals the file, and the key never travels with it. It is wrapped under a hardware root key in the SuperFile key service and released only for a licensed view.

AES‑GCM · key held apart
02

Control access

Name people and teams, block devices and IPs, geofence by country, set an expiry — for the entire life of the file.

People · Teams · Devices · Countries
03

Revoke

Pull access back in one click — even after a file has been downloaded. Web viewers go dark in about 300 ms, the Mac viewer within six seconds.

Even downloaded copies

The key never travels with the file.

Every SuperFile is sealed with AES encryption, and its key is kept apart from the file: wrapped under a hardware root key in the SuperFile key service, never inside the file itself. When someone you have approved opens it, the key is released only into the hardware-protected viewer for that one licensed view, and every release is checked and logged. That is what lets access be granted, tracked and revoked for the life of the file.

The key is held apart from the file — released only for a licensed view.

Key‑separated encryptionHardware-protected viewerPost-quantum signed · ML-DSA-65SOC 2 controlsISO 27001:2022 controlsFedRAMP 20x · listed on the MarketplaceHIPAAGDPR

Coming

On the roadmap.

Being built next. Nothing on this list is live today.

Coming

Windows app with offline leases

A native Windows viewer with persistent PlayReady licences, so a file opened once online keeps opening for the lease you set — as the Mac viewer does today.

Coming

SuperVised editing

Open a .docs in real Word. Every save becomes a signed new version, still owned by whoever protected it, with each contributor named. Shielded on Windows, trusted on Mac.

Coming

Streamed editing

For the highest classifications: desktop Office runs inside your cell and reaches the screen as hardware-protected video. Only pixels leave the enclave.

Coming

Attested Linux viewing

A Linux viewer that opens only on TPM-attested hardware with encrypted video memory. Proven in the lab; not yet a shipped tier. Until then, Linux is refused rather than rendered in software.

The things people ask us.

Which files can become a SuperFile?
Office documents, PDFs, images, video, CAD drawings (DXF and SVG), imagery (TIFF, GeoTIFF, BigTIFF, NITF) and GIS data (shapefile, KML/KMZ, GeoJSON, GeoPackage, GPX), which become drawn map pages with their attribute tables. Everything is viewed as read-only pages. DWG, point clouds and 3D/BIM models are refused with a message naming the export to make.
What actually happens to my file?
The original is AES-encrypted under a key minted for that one file, and a read-only viewing copy is rendered and packaged for hardware DRM. The name keeps its extension and gains an s — report.pdf becomes report.pdfs, or your branded extension. The container is signed with a post-quantum signature, and the viewer refuses a tampered file.
What is key‑separated encryption?
The file carries only ciphertext; its key is held apart in the SuperFile key service, wrapped under a hardware root key, and released only for a licensed view. Every open is a licence you have granted and every release is logged, so access can be tracked and revoked for the life of the file.
Can SuperFile read my file?
The key service holds your file’s key wrapped under a hardware root key and releases it only for a licensed view; every release is logged, and every licence attempt — granted or refused — is a row you can audit. Administrators cannot read content through the console. We do not claim that no one at SuperFile could ever read a file; we claim every release is controlled, logged and auditable — and in an on-premises cell the root key sits in an HSM you own.
Can I edit a SuperFile?
Not today. A SuperFile opens as read-only pages, with no text selection, printing or export. To change it, edit the source in its native application and protect it again. SuperVised editing — real Word on a .docs, with signed versions and named contributors — is on the roadmap.
Does it work offline?
On a Mac, yes, within a lease you set. A person who has opened the file online once on that Mac receives a hardware-bound key for the lease — days or a hard end date, with an optional view cap. The file then opens with no network until the lease ends; every offline open is written to a ledger signed by the Mac’s Secure Enclave and uploaded at the next connection. A machine that has never opened the file online cannot open it offline. Windows offline leases are on the roadmap.
Can someone screenshot it?
On the hardware-protected paths — FairPlay on Mac, PlayReady on Windows browsers — screenshots and screen recordings come out black. Where a platform cannot guarantee that (Linux, Firefox), SuperFile refuses to open the file rather than render it in software. A phone photograph cannot be prevented by any system; every open carries a forensic watermark that has been decoded from phone photos, so a leaked image traces to the person and session.
Can I add and remove people later?
Yes — at any time, for the entire life of the file. Add an employee, remove a client, block a device, or change the list, and it takes effect on the next open everywhere; a web viewer already open goes dark in about 300 ms, the Mac viewer within six seconds.
Can I really revoke a file after it’s downloaded?
Yes. Because access is checked on every open, a revoked file stops opening even where copies were already downloaded — they are ciphertext without a licence. The one exception is a Mac offline lease you granted: it runs until its end date or until that Mac next connects, whichever comes first.
Do recipients need to install anything?
On Windows, no: a hardware-DRM browser such as Edge or Chrome opens it. On a Mac, the SuperFile Viewer app. Linux and Firefox are refused rather than rendered in software, and there is no iOS or Android viewer today.
Can I get my originals back?
Always. An owner downloads a zip of every original from their own account, or an operator runs the exit tool for one owner or a whole cell. Before decrypting a byte it verifies each container’s signature and block hashes, and it writes a manifest signed with the cell’s post-quantum key.
Can I brand the extension as my company?
Yes. Keep the default .pdfs, or brand every file with your name — .super, .northwind, .acme — so recipients know at a glance it’s really from you. Branded extensions are $100 each, reserved on the registry.