Integrity vs encryption
Integrity answers: is this the same file that was sealed? Opcilo answers that with a SHA-256 fingerprint on every seal and a verification page anyone can open.
Encryption answers: how is the stored file protected from casual reading? Stored documents use AES-256 encryption at rest on Microsoft Azure, with TLS in transit and workspace isolation between organizations.
What “not end-to-end encrypted” means here
We do not claim end-to-end encryption. Sealing and PDF processing need server-side access to file contents. Saying otherwise would be marketing theater — not security.
Why automatic link expiry helps
Free recipient links expire after a short window so sealed downloads are not exposed indefinitely. Paid plans can choose longer durations. Expiry is an exposure control — not only a Free-tier limitation.
Check a seal yourself
Open any verification link on Verify — no login required. Independent verification is the product’s trust model: open the link or enter the code to see seal status and integrity; upload a copy for a one-time check when you want to confirm the file you hold.
X7F-G2K-9PX
Issuer: Northwind Labs
Sealed: 17 Sep 2026
Open a seal link and check status, issuer, and date — no login required.
Next steps:
- Read the Security page for the canonical trust statement.
- Review Subprocessors for Azure and partner processing locations.
- Try Verify with a seal code when you have one.
Frequently asked questions
Is Opcilo end-to-end encrypted?
No. Files are encrypted at rest with AES-256 and each seal has a SHA-256 fingerprint, but sealing and PDF processing require server-side access. We do not claim end-to-end encryption.
Where can I read the full security statement?
See the Security page for the Trust statement. For vendors and regions, see Subprocessors.