Product
Gate every share five ways. Revoke any of them in one click.
Each share carries a 32-byte token, a watermark tied to the recipient, and up to five gates the governor sets per link: password, expiry, IP allowlist, origin allowlist, country allowlist, view cap, and email verification. The recipient opens a viewer that knows them. You see who opened it, when, and where they stopped reading.
In the product
One share. One token. One recipient.
The share form
Set the recipient, the access, the watermark per link.
Name the recipient, choose the access (public, password, or email-verified), pick the visible watermark, toggle leak traceability, and read the URL it produces. Every share is a first-class record — a 32-byte token, a recipient-bound watermark, and any subset of five gates.
See the viewerRecipient
Access
Visible watermark
The five gates
Layer the gates that fit the recipient and the deal.
Each gate is set per share, runs server-side before the deck renders, and writes to the audit log on every rejection. Leave a gate empty and Codexroom treats the share as open on that dimension. Combine them freely. The IP, origin, and country gates cost nothing in latency.
Password. A passphrase the recipient enters once. Hashed with argon2id, never stored in clear. Five attempts per minute per token, then the prompt rate-limits.
IP allowlist. A list of CIDR ranges. The share opens only from inside the firewall, the office network, or the VPN you nominate. The page stays generic for a disallowed range, so a probe never learns which IP would have worked.
Origin allowlist. A list of domains the share is allowed to load from. Use it for embeds inside a partner portal or a customer data room.
Country allowlist. A list of ISO-3166 alpha-2 country codes. Geography reads from Vercel's edge geo header at city resolution, and the gate fails closed when the country is unknown.
Email verification. The recipient enters their email; Codexroom emails a 6-digit code through Resend, valid for 15 minutes. Only the argon2 hash of the code lives in the database.
View cap. A maximum number of opens. After the cap, every request is a hard reject — the self-revoking pitchbook that opens twice and then closes.
The lifecycle
Create. Send. Track. Revoke. Rotate. Audit.
Your team creates a share through the admin UI or the MCP create_share tool; the reply is the URL. Wrong tokens, expired shares, revoked shares, and wrong passwords all return the same generic page — it stays quiet about which guess got closer.
Rotate the token if the recipient name needs to change without losing the analytics. Revoke if the deal moved or the recipient changed firms; revoked shares never re-open. Both actions take one click and write an audit entry.
See it work