Your documents stay yours.
The D-SLS Management vault encrypts your documents on your device, before anything is sent. Our servers only keep unreadable data: nobody at D-SLS can read them, not even an administrator — unless you turn on e-mail recovery, which keeps a backup copy of the key.
🔒 AES-256 · end-to-end encryptionEnd-to-end encrypted
Contracts, certificates, bank details, ID documents, payslips: every file, its name and category are AES-256 encrypted in your browser. The server never receives the key.
Your keys, your control
Open it with the vault code, Face ID or Windows Hello. You decide who has access: each person gets their own copy of the key, which you can revoke.
Access log and alerts
Every opening, upload, view and download is logged. If the vault is opened from a new device, the owner is notified by e-mail.
How it works
- The owner creates the vault: a unique company key is generated on their device.
- That key is protected by the vault code (and Face ID / Windows Hello) of each authorised user.
- Every document is encrypted on the device, then uploaded. The server stores unreadable data.
- To read it, the device downloads the encrypted document and decrypts it locally.
What D-SLS can — and cannot — see
✕ Impossible for D-SLS
- The content of vault documents
- Their names, categories and your notes
- Your vault code and recovery phrase
- Your company key (when e-mail recovery is turned off)
Needed to run the service
- Account e-mail addresses and company name
- Size and upload date of encrypted files
- The technical access log (date, device, IP address)
- Business data (see below)
What if I lose access?
- Code by e-mail (recommended, on by default): a 6-digit code sent to your e-mail restores access. For this, the D-SLS Cloud keeps an encrypted backup copy of the key, usable only with that code. The owner can turn it off for total confidentiality.
- Recovery phrase + QR code: printed when the vault is created and, if you wish, sent to your e-mail, WhatsApp or SMS — from your device, never through our servers. Scan the QR and access is back.
- Several holders: a partner or your accountant can restore your access with an invitation code.
- Several devices: iPhone and PC each keep their own access.
If every copy is lost at the same time, nobody can recover the documents — not even D-SLS. That is precisely the proof that we cannot read them.
What about business data?
Quotes, invoices, accounting and stock are not in the vault: the server must be able to check them to protect you (validated invoices locked, unique numbering, closed accounting periods, role-based rights). They travel encrypted (HTTPS), are isolated per company, protected by roles, and every change is logged. In “Local” mode they never leave your browser.
AI assistant
The AI assistant never receives the content of the vault: it has no access to it.
Technical details
- AES-256-GCM for files and metadata, random initialisation vector per file
- 256-bit company key generated by the browser (Web Crypto)
- Vault code: PBKDF2-SHA-256, 600,000 iterations
- Face ID / Windows Hello: WebAuthn PRF extension + HKDF-SHA-256
- “Remember this device”: non-exportable key kept in the browser
- High-entropy invitation codes and recovery phrase (80 and 200 bits)