A drop box that does not need an account
ReceiveVault is my own product. Small firms such as accountants, lawyers and mortgage brokers collect sensitive documents from their clients, and most of them do it by email attachment. I wanted the tool I would trust with my own documents.
Where it started
Email attachments are easy, and that is the whole case for them. Once sent, a document lives in two inboxes, a sent folder and whatever backups touch them. The usual alternatives ask the client to create an account for every firm they deal with, or to install an app that fails on half the phones it meets. Firms kept the attachments because the fix always looked like a big IT project.
What the client sees
The firm sends a checklist of what it needs. The client gets a link, opens it on any device, drops the files in and is done, with no account and no password. Paper documents can be scanned to PDF from the phone camera on the same page, with the page edges straightened and several pages combined. When a firm needs a photo of government ID, the page guides the client through it and rejects shots with glare or blur before they are sent. Large uploads pick up where they left off if the connection drops, and the client gets a receipt.
What the firm gets
Every file is scanned for malware before anyone at the firm opens it. Requests can be built from templates for the firm's line of work, sent to several people at once, set to recur for the clients who send the same papers every quarter and chased with reminders until the files arrive. Finished work goes back to the client through the same portal as an expiring, tracked link that can carry a password. Firms can put their own logo, colours and domain on the client side so the whole thing looks like theirs. Files can be kept only as long as the firm's own retention rule says, and the firm can export or close its account on its own.
Security
Firms that want it can turn on end to end encryption, where the file is encrypted in the client's browser before upload and the server only ever holds ciphertext. Everything else is encrypted at rest, with encrypted offsite backups that get restored for real to prove they work. Staff sign in with passkeys and a second step, get told when a new device signs in and have to confirm their password again for the actions that matter. There is a record of who looked at what. It is hosted in Canada on infrastructure owned by a Canadian company, so the data and the company holding it both sit under Canadian law. An outside security review has been through it and its findings are closed, and every public claim about security maps to the code that makes it true.
Underneath
It is built the way I build for clients. Automated tests run on every change and each release goes through a full test environment before production and can be undone. Everything is monitored, including a scripted client that walks through an upload every day. Storage, email and download budgets are capped per account and for the platform as a whole, so one bad actor cannot run up a bill or fill a disk. Billing, plans, coupons and the account lifecycle are all built. The terms, privacy policy and processing agreement are versioned and clients accept a specific version, so there is a record of what they agreed to.
Today
ReceiveVault is in free private beta until 2027-02-28. Request access at receivevault.com.
Stack
Next.js, React, TypeScript, PostgreSQL, Docker, ClamAV, MinIO, Playwright, Prometheus and Grafana