ℹ️ You’ve received a Word doc that’s been secured with Confidencial…now what? This tutorial walks you through what to do. We’re going to pretend you are Bob, you’ve never used Confidencial before, and your coworker, Alice, has sent you a Confidencial Word doc.

1. Open the document that you received from Alice in Word
3. With the add-in installed, you can now click Confidencial on the right side of the Home toolbar
6. Once you are logged in, click View Encrypted Content in the Confidencial task pane

✅ You can now see the content that Alice protected for you.

ℹ️ Let’s say you’re George Jetson and you work at Example Company. You just finished a proposal and want to send the final product to your two subcontractors, Spacely Sprockets and Cogswell Cogs. However, there’s a problem - you can’t let them see what the other is doing in your proposal (they’re both very secretive about the work they do and the prices they charge).

In the old days, you’d have to create a separate PDF file for each subcontractor and redact the information they aren’t allowed to see. In this example, that’d mean creating three different versions of your proposal and sending a separate email for each person to get their copy. Make sure you send the right copy to the right person!

Fortunately, you don’t have to do this anymore. With Confidencial, you can do all this with a single PDF file and a single message. You don’t have multiple, unprotected copies of your proposal floating around and you don’t have to worry about getting multiple emails set up with the right attachment and sent off to the right people. Let’s see the modern way to securely share a PDF file…

2. Click PDF Protector
3. Click Open PDF File

4. Select your PDF file (our proposal in this example)
5. You can now see your proposal (PDF) in Confidencial’s PDF Protector
6. Select a part of the proposal that you only want Cosmo Spacely to be able to see
8. You and Cosmo are now in the recipients list
9. To encrypt the content you selected for Cosmo, click the “gear” button and choose Encrypt Selection from the menu, then click the blue Encrypt Selection button.
10. The selected content is now protected. Only you and Cosmo will be able to view it.
11. Repeat Steps 6-9 for the other parts of the proposal that you want to protect

    💡 Pro tip: You can remove someone from your recipients list by clicking the X next to their name.
12. With all parts protected, click the download button in the toolbar to save your PDF

    💡 Pro tip: When you download (save) the PDF file, you can overwrite the original version of the PDF. Doing so will replace the original, unprotected PDF with a protected, Confidencial PDF.
13. Now that you’ve saved your Confidencial PDF file, send it to Cosmo and Mr. Cogswell (we use Slack in this example). Remember, since access control is built directly into this PDF, you send the same version to everyone. No more sending multiple versions to multiple people with multiple messages!

✅ Your subcontractors are now ready to view the proposal.

1. Open the workbook that you received from Alice in Excel
3. With the add-in installed, you can now click Confidencial on the right side of the Home toolbar
6. Once you are logged in, click View Encrypted Content in the Confidencial task pane

✅ You can now see the content that Alice protected for you.

ℹ️ You’ve received a PDF that’s been protected with Confidencial…now what? This tutorial walks you through what to do.

Let’s say you’re Cosmo Spacely, an employee at Spacely Sprockets. A collaborator of yours at another company, George Jetson at Example Company, has sent you a Confidencial PDF in Slack (but it just as easily could have been Teams, Outlook, Google Drive, or any other way you two exchange files). As you can see below, there are some parts of the document that are encrypted. Let’s walk through how to view those encrypted parts…

3. Click PDF Protector in the sidebar menu
4. Click Open PDF File and select the PDF file you downloaded from Slack (or whatever messaging app George used to give you the PDF)
5. You can now see the PDF with the protected parts blocked off
6. Click View Encrypted Content in the right taskpane
7. The protected parts that George has allowed you to see are now visible

✅ Congrats! You now know how to view protected PDFs with Confidencial.

2. In the text input on the Encryption Tools page, enter the password you want to send to Bob
3. Enter Bob’s email address in the recipient adder
4. Since Bob isn’t an existing Confidencial user, invite him to join by clicking Send Invite to…
5. Now that you’ve invited Bob to join, click on his email in the recipient adder to add him to your protected message
6. Bob now appears, along with you, in the list of recipients for the message

   ℹ️ The recipients list determines who can view protected content. You are automatically added as a recipient of any message or file you encrypt, so you will always be able to decrypt any message or file you protect.

7. Click Encrypt
8. This produces an encrypted message that you can now send to Bob. Click Copy to Clipboard.
9. You can now paste the encrypted message into your preferred messaging tool. In this example, we will use Slack.

ℹ️ Let’s say you are Alice, an employee at an organization that is using Confidencial, and you want to send a protected Word document to your coworker, Bob, who is not using Confidencial. This tutorial walks you through how to do that.

1. In Word, open or create the Word document that you want to protect

4. Since Bob is not an existing user, click Send Invite to… to invite him to Confidencial

5. Now that Bob has been invited, select his email to add him as a recipient of the document
6. You (Alice) and Bob now appear in the recipients list

   ℹ️ The recipients list determines who can view protected content. You are automatically added as a recipient of any message or file you encrypt, so you will always be able to decrypt any message or file you protect.

7. Click Encrypt Document
8. The document is now protected. Save the document in Word.
9. Use the messaging tool of your choice (Outlook, Teams, Slack, etc.) to send the document to your coworker, Bob. In this example, we will use Slack.

   ℹ️ Note that even though the document has been encrypted with Confidencial, it remains a valid .docx file (Example.docx) and can thus still be opened in Word - no special viewer is required

✅ Bob now has the Confidencial protected Word document.

Fortunately, you don’t have to do this anymore. With Confidencial, you can add a layer of protection to your image that ensures it will be “end-to-end encrypted.” That is, the whole time the image is on your machine, the whole time it’s on your recipient’s machine, and at all times in between, the image can stay protected.

Let’s see the modern way to securely share a photo…

2. Drag your passport photo on to the encryption box of the Encryption Tools page
3. 💡 If Bob has never used Confidencial before, you will be asked to invite him after you enter his email address. Simply click the green invite button. Bob will be able to view your protected photo as soon as he verifies his email address with Confidencial.
4. You and Bob are now in the recipients list

   ℹ️ The recipients list determines who can view protected content. You are automatically added as a recipient of any message or file you encrypt, so you will always be able to decrypt any message or file you protect.

5. Select a sensitive part of the photo by clicking and dragging a box over it
6. Click Encrypt Selection in the right taskpane
7. The selected portion is now protected. Repeat Steps 5 and 6 for each portion you’d like to protect.
8. Click the download (save) button to save the protected image to your disk

   💡 Pro tip: When you download (save) the image, you can overwrite the original version of the image. Doing so will replace the original, unprotected image with a protected, Confidencial image.
9. Now that you’ve saved your Confidencial image, send it to Bob however you like. You can use email, iMessage, Slack, Teams…any method you prefer. Since access control is built directly into this image, Confidencial’s protection stays with it no matter where it goes or how it gets there.

✅ You’ve now sent your passport the safe way - the Confidencial way! If any unauthorized user intercepts your message or otherwise gets their hands on your image, below is all they will see. Only your designated encryption recipients (Bob in this example) will be able to see the protected content using Confidencial.

ℹ️ Let’s say you are Alice, an employee at an organization that is using Confidencial, and you want to send a protected Excel workbook to your coworker, Bob, who is not using Confidencial. This tutorial walks you through how to do that.

1. In Excel, open or create the Excel workbook that you want to protect

4. Since Bob is not an existing user, click Send Invite to… to invite him to Confidencial

5. Now that Bob has been invited, select his email to add him as a recipient of the workbook
6. You (Alice) and Bob now appear in the recipients list

   ℹ️ The recipients list determines who can view protected content. You are automatically added as a recipient of any message or file you encrypt, so you will always be able to decrypt any message or file you protect.

7. Click Encrypt Workbook
8. The workbook is now protected. Save the workbook in Excel.

   💡 By default, Confidencial encrypts the entire workbook. If you want to encrypt only certain parts of the workbook, click the “gear” menu and choose Encrypt Selection.

   💡 Pro tip: Even after you’ve protected a workbook by clicking Encrypt Workbook, you can add additional content to your workbook - this content will remain visible to anyone who has access to the workbook. The protected content that you encrypted in the previous step will still only be visible to the people you designate in the recipients list.
9. Use the messaging tool of your choice (Outlook, Teams, Slack, etc.) to send the workbook to your coworker, Bob. In this example, we will use Slack.

   ℹ️ Note that even though the workbook has been encrypted with Confidencial, it remains a valid .xlsx file (Example.xlsx) and can thus still be opened in Excel - no special viewer is required

✅ Bob now has the Confidencial protected Excel workbook.

ℹ️ You’ve received an image that’s been protected with Confidencial…now what? This tutorial walks you through what to do. We’re going to pretend you are Bob who works at The Example Hotel, you’ve never used Confidencial before, and one of your international guests, Happy Traveler, has sent you a photo of her passport.

1. If you open the image that you received from Happy in your default image viewer, you will see an image like that above. You will be able to see all the parts of the image that Happy chose not to protect. To see the protected parts, continue to the steps below.
4. Once you are logged in, drag the protected Confidencial image file on to the encryption box of the Encryption Tools page
5. The protected image is now displayed in the Confidencial Image Protector
6. Click View Encrypted Content in the right taskpane

✅ You can now see the content that Happy protected for you.

Tutorials

ℹ️ Guides that walk you through common scenarios

Instructions

ℹ️ Step-by-step instructions for using specific features

💡 Confidencial takes an end-to-end approach to securing your messages and files. What does this mean? In short, it means that in most* cases, Confidencial does not see or store the private keys that are required to decrypt messages and files and in all cases we do not ever see (let alone store) your messages and files, even in their encrypted form. Read on for more information about our approach to keeping your data safe.

Confidencial’s implementation is a true end-to-end secure solution to protecting your most sensitive data. This approach is perhaps best described by example; let’s review a couple of these.

How Confidencial protects your data at rest

Encrypting the document

When you click Encrypt Document, here is what happens:

2. Confidencial takes all the content in your document and encrypts it using your public key*

   *️⃣ Technically, we encrypt the content of your document with a symmetric (AES) key. That symmetric key is then encrypted using your public key.

3. The encrypted data is then inserted into your document as metadata

   ℹ️ Metadata is auxiliary information - it’s data about your data. Other examples of metadata in a Word document include the document author’s name, the title of the document, and the name of the template upon which the document is based.

5. When you save the document, its contents are now protected at rest

Decrypting the document

1. Confidencial retrieves your private decryption key
2. The encrypted document data is extracted from the metadata of the document

3. Your private key is used to decrypt the data

4. The decrypted data is re-inserted into your document for viewing and editing

5. When you are done viewing and editing the document, clicking Re-encrypt Before Saving protects the data by executing the steps described in the “Encrypting the document” section above

🔒 At no point during this entire encrypt-decrypt process did your document’s contents get sent to Confidencial. All encryption and decryption is done locally on your machine. It is an end-to-end secure process.

How Confidencial protects your data in transit

💬 With the release of Confidencial 2.2, you will be able to send messages and files directly from the Confidencial web or desktop app using Slack, Outlook, or Gmail! Check back here after the release of V2.2 for a description of how Confidencial implements an end-to-end solution for data sharing using your favorite messaging apps.

What is it?

What does it mean for me?

What file formats are supported?

What about formats that aren’t supported?

1. Along with the protected message from Alice, you will also receive an invitation email to join Confidencial. Click on the button in that email to create your Confidencial account.
2. After you click the registration link, enter a password and click Continue to create a dedicated Confidencial account or click Continue with Google or Continue with Microsoft to create an account based on an existing Google or Microsoft account, respectively
3. If prompted, provide consent to Confidencial to access certain information from your Google or Microsoft account. Confidencial requires information such as your email address and name to allow other users to find you and encrypt information for you.

4. Since this is your first time logging in, click Generate Keys. Confidencial creates your public and private encryption keys at this time. On subsequent logins, the keys you generated will be loaded automatically.
5. You are now taken to Confidencial’s web app, where you are able to protect and view messages
6. Copy the Confidencial protected message you received from your messaging tool onto your clipboard. In this example, we use Slack.
7. Go back to your web browser and paste the protected message into the input box on the Encryption Tools page

   ⚠️ Be sure to include the “BEGIN CONFIDENCIAL ENCRYPTED MESSAGE” and “END CONFIDENCIAL ENCRYPTED MESSAGE” parts of the protected message when pasting into the input box.

8. Click Decrypt
9. You can now view the protected message and copy it into other programs

✅ This is how you view protected messages with Confidencial.

ℹ️ See the links below for instructions on how to deploy the Confidencial Private Key Server

Protecting content in Microsoft Office

Protecting content with the Confidencial web app

Protecting content with the Confidencial desktop app

This documentation is coming soon

This documentation will be coming soon

Natively-protected files

Confidencial supports several types of files natively. That is, Confidencial encrypts content within these types of files while preserving the native format of the file. These file types include Word docs (.docx), Excel workbooks (.xlsx), and portable document format files (.pdf).

Microsoft Word and Excel

PDF files

Images (JPEG and PNG)

Just like for PDF files, Confidencial also supports native (format-preserving) protection of JPEG and PNG images in its desktop and web apps. Confidencial users can load an image in Image Protector to protect all or parts of an image. Again, like PDF files, protected images remain in their native format, so they can continue to be viewed in standard (default) images viewers with unprotected parts continuing to be visible. However, one must use the Confidencial desktop or web app (and be authorized) to view protected portions of images.

.C11-protected files and file bundles

All files types that aren’t natively supported by Confidencial’s apps and add-ins can nonetheless still be protected by encrypting them with Confidencial’s .c11 file format. Like natively-supported file types, users encrypt other file types for a specific set of recipients. Users may protect either a single file or a bundle of files in this manner. Encryption and decryption can be performed in either the desktop or web app.

⚠️ It is strongly recommended to NOT store device-stored keys on a device that also contains Confidencial-protected messages and files. If keys and the data protected with those keys are stored on the same device, an attacker who gains access to that device would theoretically be able to view your protected data. Instead, it is recommended that device-stored keys be stored on a device, [such as an HSM](https://en.wikipedia.org/wiki/Hardware_security_module), that is dedicated to storing cryptographic keys.

2. If you are logging in with an organization account, enter your organization name and click Continue. If you are logging in with an individual account, proceed to Step 3.
3. Enter your email address and password and click Continue or log in with your existing Microsoft or Google account by clicking Continue with Microsoft or Continue with Google, respectively

✅ This completes the login process. You are now ready to protect your content using Confidencial.

What this means is that an attacker would have to compromise Confidencial’s backend infrastructure AND a third-party’s backend infrastructure AND they would have to compromise your chosen document store - whether that be the cloud, your organization’s internal network, or your computer - to gain access to your Confidencial-protected data.

An Encryption Policy is a set of Confidencial users that have permission to view content within a Confidencial-protected document. Every policy you create (every different set of people you encrypt for) is automatically saved by Confidencial and can be accessed later using the left arrow and right arrow browse buttons located above the Add person to policy input box. This allows you to encrypt for commonly-used groups of people without manually adding each member of the group to the policy one-by-one.

ℹ️ These instructions cover how to choose who can see the content in your messages and files

ℹ️ Note that when you protect content you are automatically added as a recipient, so you will always be able to see content that you protect for others

1. Choose who you want to see your content

   2. If you want to encrypt for a new set of people, click in the Add person to policy input box. There you will see the people for which you have most recently encrypted. You can also type in a user’s email address if you have not encrypted for them before.
2. If you want to remove a user from your recipient list, click the X next to the user’s name
3. Once the desired recipients are selected, click Encrypt to protect the content

2. If you are logging in with an organization account, enter your organization name and click Continue. If you are logging in with an individual account, proceed to Step 3.
3. Enter your email address and password and click Continue or log in with your existing Microsoft or Google account by clicking Continue with Microsoft or Continue with Google, respectively

✅ This completes the login process. You are now ready to protect your content using Confidencial.

There are two ways to invite users to join Confidencial with an individual account:

Inviting users via the Invites page in the web or desktop app

2. Click Invite People to Confidencial
3. Enter the email addresses of the people you want to invite (up to 5 at a time) and click Send Invites

✅ The users you invited will now receive invitation emails. You may now encrypt content for them.

Inviting users via the recipient box in the web app, desktop app, or Office add-ins

1. From the Encryption page of the web or desktop app, or the task pane of an Office add-in, enter the email address or the person you want to invite in the recipient box
2. Click Send Invite to…

✅ The user you invited will now receive an invitation email. You may now encrypt content for them.

💡 You can track the status of all your invites by clicking Invite in the web or desktop app. You can resend invite emails to users by clicking Send Again. When a user accepts your invitation, their status will change from pending to accepted.

2. In the Encryption Tools page, enter or paste a text message into the encryption input box
4. Click Encrypt

5. Copy the protected (encrypted) message to your clipboard by clicking Copy to Clipboard

✅ You have now generated a protected message. You can paste this protected message in an app of your choosing to send to your recipient(s).

⚠️ The Confidencial app does not send messages to your recipients directly. You must do so using a third-party app of your choosing, such as Slack, Outlook, or Teams. Confidencial will support direct sending of messages from its apps via these platforms in a future release.

1. From the Encryption Tools page, choose the files and/or folders you want to protect. There are two ways to do this.

   1. You can choose files and folders by clicking the choose files link in the input box

   2. You can drag and drop files and/or folders onto the input box
3. Click Encrypt
4. Click Save File to choose a location to store your Confidencial-protected file

✅ You have now created a Confidencial-protected file that contains the files and/or folders you selected.

ℹ️ These instructions show you how to decrypt a message you’ve received from another Confidencial user with the Confidencial web app. You can also decrypt messages with the Confidencial desktop app using a similar process.

1. Copy the encrypted message you’ve received in to your clipboard

   💡 To copy to your clipboard

   Menu (macOS or Windows): Edit → Copy

   macOS: ⌘ + C

   Windows: CTRL + C

3. Paste the encrypted message from your clipboard to the input box on the Encryption Tools page and click Decrypt

   ⚠️ Be sure to paste the entire encrypted message, including the parts that say “BEGIN CONFIDENCIAL ENCRYPTED MESSAGE” and “END CONFIDENCIAL ENCRYPTED MESSAGE” 💡 To paste from your clipboard

   Menu (macOS or Windows): Edit → Paste

   macOS: ⌘ + V

   Windows: CTRL + V

   ✅ Your decrypted message will appear along with options to save the message to a file or copy the message to your clipboard

1. Drag and drop the Confidencial protected file into the encryption box or click choose files and select the file in the Encryption Tools page
2. Click Decrypt
3. If the protected (encrypted) file is a .c11 file, you can save an unprotected (decrypted) version of the file by clicking Save File. If the protected file is a .c11.zip file (a file bundle), clicking Save File will allow you to save a zip file containing unprotected versions of each file within the bundle.

✅ The completes decryption of Confidencial-protected files. These unprotected files are now available to be opened in their native viewers/editors.

ℹ️ These instructions show you how to change the contents of a Confidencial-protected (.c11) file (and who can see those contents). The process amounts to decrypting the file(s) or folder(s), making any desired changes to the decrypted content, and encrypting the decrypted content for a new group of recipients. In an upcoming version of Confidencial, you will be able to change who can see the contents of a Confidencial-protected file without decrypting and re-encrypting.

1. ℹ️ Viewership: Who can see the contents of a Confidencial-protected file or folder

2. Make any desired changes to the unencrypted contents of the .c11 file

✅ This completes editing the content of a protected file and re-encrypting the protected file for a new group of recipients

There are two primary ways to create an individual account with Confidencial. You can register an account by accepting an invitation from another Confidencial user or you can create an account without an invitation.

Accepting an invitation to create a Confidencial individual account

1. If you have received an invitation to join Confidencial with an individual account, you will receive an email with a link to start the registration process. Click Click here to get started to start account registration.
2. After you click the registration link, enter a password and click Continue to create a dedicated Confidencial account or click Continue with Google or Continue with Microsoft to create an account based on an existing Google or Microsoft account, respectively
3. If prompted, provide consent to Confidencial to access certain information from your Google or Microsoft account. Confidencial requires information such as your email address and name to allow other users to find you and encrypt information for you.

Creating a Confidencial individual account without an invitation

1. Go to my.confidencial.io

2. Click Sign Up
3. Enter your email address and create a password and click Continue to create a dedicated Confidencial account or click Continue with Google or Continue with Microsoft to create an account based on an existing Google or Microsoft account, respectively
4. Depending on how you chose to create an account, you may be asked to verify your email. If you are asked to verify your email, you will receive a verification email. Follow the instructions in that email to continue creating your account.

Opening the task pane in Word, Excel, and PowerPoint

In Word, Excel, and PowerPoint, click Confidencial in the Home ribbon

✅ This will open the Confidencial task pane

Opening the task pane in Outlook

In Outlook, click Confidencial in the main toolbar

✅ This will open the Confidencial task pane

Installing Confidencial for Word and Excel

1. In either Word or Excel, navigate to the Insert ribbon (toolbar)
2. (If visible) click Add-ins

3. Click My Add-ins
4. In the Office Add-ins pop-up window, click STORE

5. Search for confidencial
6. Click the Add button next to Confidencial for Word and Excel, then click Continue to accept the license terms and privacy policy
7. You can now launch the Confidencial add-in from the Home ribbon (toolbar)

✅ This completes installation of the Confidencial add-in for Word and Excel

Installing Confidencial for Outlook

⚠️ Microsoft Outlook does not support the use of add-ins with certain email server and client platforms. On Windows, you must have an Exchanged-based email account to use add-ins. On macOS, you must have an Exchange- or Google-based email account to use add-ins.

1. (If visible) click “…” in the toolbar

2. Click Get Add-ins

   ⚠️ If you are using a supported server and client, you will be able to see a Get Add-ins button on your Outlook toolbar. If the button is not visible or is disabled, select an email message from an eligible email account to display it in the message preview window. If the Get Add-ins button is still not visible or is disabled, then you are likely not using an email account that is compatible with Outlook add-ins.
3. Search for confidencial
4. Click the Add button next to Confidencial for Outlook, then (if presented) click Continue to accept the license terms and privacy policy

✅ This completes installation of the Confidencial add-in for Outlook

2. Click Install on the sidebar menu
3. Click on the appropriate download button, based on your operating system

✅ This completes installation of the Confidencial desktop app. You can now open the app by double-clicking its icon or by double-clicking a .c11 file.

⚠️ If you are using Confidencial at work, you will likely need to have add-ins installed by your organization’s IT administrator

ℹ️ These instructions cover how to log in to Confidencial add-ins for Microsoft Office. While the examples below show Microsoft Word, the process is the same for all Microsoft Office apps.

Start by clicking Confidencial in the main toolbar

2. If you are logging in with an organization account, enter your organization name and click Continue. If you are logging in with an individual account, proceed to Step 3.
3. Enter your email address and password and click Continue or log in with your existing Microsoft or Google account by clicking Continue with Microsoft or Continue with Google, respectively

✅ This completes the login process. You are now ready to protect your content using Confidencial.

Start by double-clicking the .c11 file; this will open the Confidencial desktop app

1. Drag and drop the Confidencial protected file into the encryption box or click choose files and select the file in the Encryption Tools page
2. Click Decrypt
3. If the protected (encrypted) file is a .c11 file, you can save an unprotected (decrypted) version of the file by clicking Save File. If the protected file is a .c11.zip file (a file bundle), clicking Save File will allow you to save a zip file containing unprotected versions of each file within the bundle.

✅ The completes decryption of Confidencial-protected files. These unprotected files are now available to be opened in their native viewers/editors.

2. Click Encrypt Selection under the Settings menu (gear icon) of the Confidencial task pane
3. Select content in your Word document that you want to protect
4. ℹ️ Note that you are automatically added as a recipient, so you will always be to view any content that you protect

5. Click Encrypt Selection

✅ The selected content is now protected for your chosen recipients. Repeat Steps 3 - 5 to protect other parts of your document.

Re-encrypting a Word document for the original recipients

2. Click Re-encrypt Before Saving in the Confidencial task pane
3. Save the document

✅ This will protect all content in the document for the original group of recipients

ℹ️ If the document was in the protected state (encrypted content not visible) during the last time you saved the document, you can also close the document without saving. This will leave the document in the protected state with the original recipients intact. However, it is best practice to click Re-encrypt Before Saving and re-save the document to guarantee that the document is saved in the protected state.

⚠️ If you save and share the document before clicking Re-encrypt Before Saving, all decrypted contents in the document will be visible to anyone who gains access to and opens the document.

Re-encrypting a Word document for a new group of recipients

2. Remove encryption from the content for which you want to change the recipients

3. With Confidencial protection removed from the necessary parts of the document, you can now re-encrypt the content for a new group of recipients

   1. ✅ This will re-encrypt the entire document for the new group of recipients and put the document in the protected state. The document can now be safely distributed.
   2. ✅ This will re-encrypt the parts for the new group of recipients and put the document in the protected state. The document can now be safely distributed.

2. Click Key Management under the Advanced section of the left sidebar menu
3. Information about your current encryption key is displayed. By default, your private encryption key is a cloud-stored key, which means it is split (sharded), with the parts stored across multiple, isolated cloud locations. To switch to a device-stored key - a key you store on a device of your choosing - click Replace Current Encryption Key.
4. Select Local File Storage then click Replace Current Key
5. Your new private encryption key is downloaded to your device (as indicated by the green highlight box in the lower left of the screen below)
6. Click the menu next to the downloaded key file to save it in a reliable, secure location. Most browsers will store files in your Downloads folder, so you will need to open that folder and transfer the key file (the name will be something like c11_key_165bd1c523605d77.key) to a safe location/device.

2. Click Encrypt Document

✅ Your document is protected. You may now save it and safely send it to others.

💡Confidencial deploys Microsoft Office Web add-ins. These are built using web technologies (HTML, JavaScript, and CSS) and leverage the Office JavaScript API to interact with Office applications like Word, Excel, Outlook, and PowerPoint.

Confidencial offers central management of the add-ins for enterprise deployments where admins elect to push the add-ins to end devices.

Option 1: Via Microsoft 365 Admin Center

2. Navigate to Settings > Integrated apps
3. Select "Add-ins"
4. Click "Deploy add-in" and then "Next"
5. Choose "Choose from the store"
6. Search for "Confidencial" in the search bar
7. Select "Add" for the desired add-ins (Word, Excel, and/or Outlook)
8. Assign users as needed and click "Deploy"
9. Test the deployment using the available options

Your add-ins are now successfully deployed.

Option 2: Via Desktop Installer

For installation via Windows or macOS installer, please contact your Confidencial team for detailed instructions and support.

Note: After deployment, users can access the enabled add-ins under "My Add-ins" in their Microsoft Office applications.

1. Open the Confidencial-protected Word document in Word
3. Click View Encrypted Content in the Confidencial task pane

✅ You can now see the content that was encrypted for you and make changes to it

⚠️ If you want to re-save your document - for example, if you made changes and want to save them - be sure to first click Re-encrypt Before Saving before you save. If you save your document without re-encrypting, your content will not be protected.

2. Click Machine Tokens under the Advanced section of the left sidebar menu
3. Click New Machine Token
4. Give your token a name and optionally a description and click Create Token
5. Your machine token will now be displayed

⚠️ Your machine tokens allow anyone with access to them to perform Confidencial actions on your behalf. Be sure to store these tokens securely!

🗑️ If you need to revoke a machine token, you can do so by clicking the corresponding delete link on the Machine Tokens page

2. Click Key Management under the Advanced section of the left sidebar menu
3. Your keys are listed in the main panel. For each key pair that you wish to use with the SDK:

   1. Copy the public key hash and store it in a location that you can access from your code
   2. Click View Private Key and copy the private key, as it is presented in PEM format, and store it in a location that you can access from your code

   ⚠️ Private keys permit the decryption of files. They should be stored in a secure location!

Secure Document Request Overview

Creating A Secure Document Request

Click on the “New Document Request” button in the top-right corner of this screen. This will allow you to choose from the existing templates to quickly create a new secure document request.

Choosing an Existing Template

On the resulting screen you will see a list of existing templates that can be used for requests. Your organization may have lots of templates pre-configured for you to use. Choose the “Organization Templates” tab and click on the arrow on the right hand side of the template name in order to begin your request.

Customizing your Request

Fill in the following details: (* are required fields)

Document Request Details:

*Request name or ID: This allows you to set a unique name for your request. If you have a lot of requests it can be important to come up with a naming scheme so that you can easily search or scroll to find a particular request later.

Project Name: Filling in project name make it easy for you to categorize and search for historical requests. This also allows you to dictate where requested information will reside in backend storage.

Recipient Information:

*Recipient full name: This name will appear in the email sent to the recipient of the request. It’s important to set the properly to reduce confusion by the recipient of the request.

Require Fields: Leave checked any fields from the template that you want to include and clear any that are not needed in this particular request. Note that you cannot change the required status of the field (that’s done in the template configuration); if you include a required field it will be required for the user to complete the form.

Additional Options

Require one time password: This is an email verification feature that sends a code to the recipient and this code will be required prior to them opening the request.

Skip Encryption: If for any reason you do not want the information to be encrypted once received, meaning anyone can view the information this option is available.

Once you have completed the configuration of your request hit the Next button at the bottom of the page to proceed to set your encryption policies.

Encryption Policies

Encryption policies allow you to add other users or groups that can access the information once it has been submitted. Users and groups included in the encryption policy will be able to see the request in their list as well as see the status and, once completed, access the information submitted by the recipient.

Add users to the policy in the same way you would throughout the Confidencial.io interface, previous encryption policies that you have used are accessed using the left-right arrows at the top right corner of the policy interface.

Once your policy is complete you are ready to review and send the request to the recipient. Click the send request button at the bottom of the page and an email will be sent to the recipient, initiating the SDR process.

The Review fields are as follows:

• Title: Shown to the recipient, this is the title of the form that the user will fill out to respond to the request. Use a short but descriptive title that describes the type of information for which you are asking.

• Subtitle: Shown to the recipient. Provide additional details about the request or provide additional instructions.

• Description: Not shown to the recipient. This is used internally to help users choose the correct template.

• Name - Not shown to the recipient. Used internally to name the template helping for searching or scrolling when looking for the template.

• isPrivate: Not shown to the recipient. This field indicates whether or not this template is shared with your organization or is only private to you.

Viewing Secure Document Requests

The list of document requests to which you have access is displayed as soon as you navigate to “Document Requests” on the left hand navigation menu. On this page you have multiple options to search, sort and view requests that you have created as well as those shared with you.

Request Status

Each document request has several attributes that you can view. On the left-hand list of document requests you can see the name of the request, to whom it was sent, as well as it’s age. Additionally you have a status “pill” which will show you the state of the request. The following states apply to document requests:

Not Started: The request has been sent but the recipient of the request has not yet submitted any of the related information.

Pending: The recipient has started fulfilling the request but has not yet completed all of the mandatory fields and documents.

Complete: The request has been fulfilled and the recipient has completed all of the mandatory fields and files and submitted the response. This is ready for you to view the data.

Viewing Requested Data

You can search for a specific request using the Search button. Search by:

• Request Name

• Request Uniqe ID (UUID)

• Project Name

• Date Range

Select the desired request.

Text viewing options:

1. Show Encrypted Text: If you have been added to the policy to view the data for this request the fields will change from **** to text that was uploaded.

2. Download all: Will download text and forms combined in a zip file

3. Download Text Only: Will download text in JSON.txt file

Form viewing options:

1. View: View in Confidencial PDF viewer

2. Download Encrypted: Form will be downloaded locally in encrypted form

3. Download Unencrypted: Form will be dowloaded locally in unencrypted form

Creating and Sharing Templates for SDR

You are able to create your own secure document templates used to create requests. You can even share them with your organization to avoid duplicate efforts and ensure consistent requests.

Creating a new Template

To Create and SDR template choose Document Request > Send New Document Request > + New Template

Template Details

1. Fill out template name (this name is applied to the template itself and will show up in the list of templates)

2. Fill out Document request title (this will appear in the blue bar at the top of the request for the recipients to see as they are filling out the requests.)

3. Fill out Notification email subject line (this will appear as the subject of the email sent to the recipients

Document request title: Title that will appear in the list of document requests

Document request subtitle: Subtitle that will appear under the title in the list of document requests

Notification email subject line: Email subject line that will appear in the inbox of the recipient

Header image URL: Provide a custom image URL that will appear on the header of each page of the form sent the the recipient.

Background image URL: Provide a custom image URL that will appear as the background image of the form sent to the recipient.

Require one time password: This is an email verification feature that sends a separate code to the recipient which will be required prior to them opening the request.

Use template-defined access policies: This will remove the option for you to define a custom access policy for this request and use the one that was defined on the template during template creation.

Adding Sections

You can create multiple sections for a document request. Section types include:

Custom Form: Choose when looking to request information to be filled out or uploaded in fields.

W9 Form: Choose if looking to request recipients fill out W9 form

Terms: Choose if you want to add a terms section within your request. Ex: Terms and Conditions

Success Message: Choose if you want to add a custom success message at the end of the request.

*Note Confidencial automatically shows a successful upload message and sends a success email once recipients complete the request.

The Custom Form> Section type allows you to create a section with one or multiple field types to be filled out by a recipient.

Adding Custom Form Fields

To add a Field Type such as a file upload box to your section, choose Custom Form > section type, File > field type

1. Add a Field Name

2. Select allowed file types to be uploaded by recipients

3. Select add field to add additional File upload boxes

4. Select add field

*if adding addition file upload boxes select “Make Field Optional” this will ensure they can still submit the request if only one file/folder is uploaded.

To another Field Type to this sections such as a Text area select the Textarea > field type

1. Add a Field Name

2. Select Min and Max Length if desired

3. Select add field

This process can be repeated with as many fields your form required.

When you have added all the appropriate fields select Add Section.

Once you have completed your template select Preview to view what is will look like when sent to the recipients.

Example Instructions Section:

Example Custom Form Section:

Once you have previewed the template and have no additional edits select Done to save the template.

The template will now appear in your template list, and you can use it by clicking the arrow on the right of the desired template in your list.

💡 File upload requests: When requesting file uploads you are able to combine them with other information requests like shown in the Client Intake Form above. you can also create templates for file request only. Confidencial can support any file types and file sizes up to terabytes.

Additional Form Section Examples

Copying/Editing Templates

To edit a template you must copy it from the original and then you can edit the copied version.

It is recommended you re-name your copied template.

Once you have copied the template you can edit any section of the template by clicking on the three dots > Edit.

Once you have complete the changes click on save changes.

There are two ways to load a device-stored key, described in the sections below:

Loading a key during decryption

ℹ️ When you attempt to decrypt protected content and have not loaded the decryption key(s) needed to do so, the Confidencial app will prompt you to load the required key(s)

2. Load the file or message you wish to decrypt in the Encryption Tools page or open a file in the PDF Protector or Image Protector
3. Click Decrypt. Since the private key required to decrypt hasn’t been loaded yet, you are prompted to load the key now. Click Load Key From File.
4. Select the requested key file and click Open

✅ Your message or file will now be decrypted and the key you loaded will remain available until you log out

Loading a key via the Key Management page

ℹ️ You can load device-stored keys without attempting to decrypt a message or file via the Key Management page

2. Click Key Management under the Advanced section of the right sidebar menu
3. For each key that you want to load, click the appropriate Load Private Key File link
4. Select the requested key file and click Open

✅ The key you loaded will remain available until you log out

💡 Confidencial’s Secure Document Send Feature can be used to create a persistent share. These shares can be sent to third parties who can then upload files once or repeatedly using the same link. Persistent sharing is fully secured with end-to-end encryption is is a great replacement for SFTP or other less secure files sharing options.

1. Navigate to: Document Sends > + New Document Send

1. Toggle: Allow participants to upload

2. Select applicable data label for information shared

   *Optional: You can set and expiration for the share to be active by toggling Set expiration and adding a date.

3. Add desired recipients emails *if a new user is added it will prompt you to click Send to a new user”
4. Once all desired recipients are added > Send

Sending a Document Using Secure Document Send

1. Navigate to: Document Sends > + New Document Send

Starting a new secure document send

1. Select desired Files or Folders

2. Enter the following information:

   1. Name: This name will appear in your Secure Doc send history list

   2. Description: This will appear under the name in your Secure Doc history list

   3. Message to Recipient(s): This message will be show to recipients on the email notification here they are notified that files have been shared.

   4. View-Only: Recipients will only be able to view the contents of the files sent and not be able to download the files locally. This is the most secure sharing option. It ensures you have full control of the documents shared and enables expiration of document access as users need to use the link provided to access the contents of the files.

   *Current files types supported for view-only sends are PDF & MS Office Documents

   1. Disallow Decrypted Downloads: Recipients will only be able to access the contents for shared files using the link provided and viewing using the Confidencial web app or viewers can download and encrypted version locally and will need to decrypt using the web application or MS add-ins. This is a secure method of sharing documents used for when you do not want recipients to be able to have an un-encrypted version of the shared file saved locally.

   2. Request Expiry: This provides the sender the option to specify an expiry time period for access to the shared files.

   3. Data Label: Select the labels that apply to type of data in the files shared. This enables your organization to report on the type of information sent and received.

      1. You must select one data label if this has been enabled by and admin in your org

3. Add Recipients: Enter the email address of desired recipient(s).

*One or many recipients can be added *Recipients DO NOT need to have a Confidencial Account to receive files

• Select Send Documents

You have completed the secure doc send workflow.

Uploading Your Files

1. You have received an email from noreply@confidencial.io subject: You have been added to a new persistent file share.
2. Open the email and click the button “Access Files”
3. You will be sent a verification code to your email. Enter the code provided. *Please make sure to check your spam and to make sure you have the most recent code if you are having issues.
4. Once authenticated a tab will open with an interface allowing you to add files.

5. Upload desired files > Send
6. Uploaded files will now be added to the persistent share and be accessible by both the sender and the requester.

NOTE: Bookmark the URL for fast access if you will be uploading multiple files overtime. Or you can access the link through the email sent.

💡 Users will be able to view their own historical doc sends and information associated.

Viewing Recipient’s Activities and Tracing Events

Your historical document sends will be listed on the right hand side of the Document Send home screen. With each document send you are able to view details of what was sent and tracing activities on the documents shared.

Viewing Recipients Activities

1. Select a completed document send

2. The Recipients tab will list out the recipients of the documents and show the associated activity as “Viewed” or “Not Viewed”

3. If a recipient has Viewed the document you will be able to “View Activity”

This will show you the details of the activities taken by the recipients on which file.

Viewing Tracing Events

Tracing events will show you when activities have been taken on each file sent.

1. Select the Tracing Events tab
2. Click on the file to obtain the details of the tracing events for the file
3. Select Tracing Map to view where the tracing events took place

Viewing Sent Documents and Details

On Historical Sends you will also be able to view the list of Sent Documents and any details provided with the documents sent to recipients.

1. Select the Sent Documents Tab to view all documents sent for that doc send
2. Select the Details tab to view any details provided to recipients

Coming Soon

Quick Start

To start using Cloud Protector, you will need to do a few configuration steps. See this menu on the left side? Let's get you started, moving from bottom to top.

2. Visit "Analyze and Protect" to run your first scan, or set up a schedule.

3. Visit "Reports" to see your scan results in real-time.

4. Visit "Data Source Explorer" to see the current state of your data source(s) — what's protected, what's not, and where the hotspots are.

5. Visit "Home" to see statistics and visualizations of your overall security posture.

Connecting a Data Source

In order to connect Cloud Protector to your AWS S3 file system, your administrator will need to log into AWS S3 and collect a few values:

2. Bucket: This is the name of the resource. Click "Services", then "Config", then click the name of the Config. The S3 bucket name will be displayed in the "S3 bucket" field.

3. Region: This is the AWS region that the bucket is in, e.g. "us-west-2". Click "Services," then "S3." The region of the bucket is in the "AWS Region" column in the Buckets list.

When you have these in hand, log into Cloud Protector and go to Settings > “Add Source.” Fill out the form.

1. Give your source a name that will help you recognize it.

2. Input the Path: the actual file path in the cloud storage that you want to analyze, encrypt, or both. Leaving this as “/” will include the whole file system.

3. Input the other values you have gathered.

4. Click “Test Connection & Save”.

Coming Soon

Coming Soon

Overview

• User Id (Object Id)

• Tenant Id

• Client Id

• Client Secret*

• Make sure to copy and save the client secret after having followed the steps to generate it, as you cannot go back to access it once it has been created.