Files screen

The Files screen manages file records in the active vault; it is not a general document archive, network share, or cloud-storage client.

Access and license boundary

The Files screen is available to every role except Auditor, and only for assigned vaults that are unlocked. The Viewer, Editor, and Manager vault roles can list and download file records.

Creating a new file, replacing a file, creating a copy, editing record details, or deleting requires a writable license and the Editor or Manager role on the active vault. The Viewer role and a read-only license block these changes but not downloading an existing file. Files needs no separate license feature. Bulk share opens the Sharing workflow, where the Sharing license feature and Sharing’s own role rules also apply.

What you can do here

• Use Search files to search file records in the active vault.
• Use Add smart filter to combine imported, warning, category, tag, or product matches.
• Return to the All quick filter, choose Cards or Table, and use Refresh to reload the vault list.
• If you have write access, use New file to create an encrypted file record.
• Review the file name, size, chunk count, shortened SHA-256 hash, and last-updated time on a row.
• Use Download file to decrypt the file in the browser and download it.
• Use VirusTotal hash lookup to search only the file hash on VirusTotal.
• Open More actions to Create a copy, Edit secret, or Delete secret.
• Select rows and use Bulk actions for operations that apply to file records.

File size, chunks, and encryption boundary

A selected file cannot exceed 1 GB. Each user can also store at most 1 GB of files per vault, so a smaller file can still be rejected when space runs out. Files does not show the exact remaining space; the limit is enforced while the file uploads.

VaultPilot stores a file in encrypted parts (chunks). The SHA-256 is calculated in the browser during save, and every part is encrypted in the browser with the active vault key. The server stores only encrypted parts and their size and order. It never keeps a readable copy of the file or moves it to separate cloud storage.

The chunk count and size on a row are record details. The shortened SHA-256 value helps identify a file; it does not make confidential file contents safe to disclose.

Create a new file

1. Confirm that the intended writable vault is active.
2. Choose New file.
3. Enter the required Title.
4. Optionally complete Owner or recipient, Related system or ticket, and File note.
5. Choose one file with Select file. The screen shows its name, size, and chunk count; if Title is empty, the file name becomes the title.
6. Choose Save encrypted record. Progress first covers the record, then encryption and upload of the file.
7. When the operation completes, check the file name, size, chunk count, and SHA-256 value in Files.

A file is required for a new record. A file over 1 GB is cleared from the form. Saving also fails when the vault is locked, your role cannot write, the license is read-only, or your file space in the vault is full.

Edit, replace, copy, and delete

Edit secret opens the current title, owner, related-system, and note details. Replacing the file is optional. If you choose a new file under Replace file, VaultPilot encrypts the record again, removes the old file, and uploads the new one. Do not leave the page while save is in progress.

Create a copy is not a clipboard action. VaultPilot decrypts the file in the browser, encrypts it again for a new record, and creates a separate file record in the same vault. No copy is created when the source file is incomplete; VaultPilot tries to remove an incomplete copy.

Delete secret permanently removes the file record and its encrypted file from the server after confirmation. It cannot be undone. Bulk delete also requires confirmation; if a batch partly fails, refresh and check the records that remain.

Download, reveal, copy, and audit behavior

File rows do not offer Reveal secret or Copy secret value. File contents are never shown in the row or placed on the clipboard. Download file fetches the encrypted parts, checks that all are present, decrypts them in the browser, and hands the file to the browser’s download. The vault must be unlocked.

The audit history records the download as an export as soon as the server hands out the file, before the browser checks, decrypts, or saves it. An export entry can therefore exist even when the file was incomplete, the download failed, or Create a copy stopped early. Preparing a share also reads the file and can create the same entry even when the package is never created.

VirusTotal hash lookup does not upload the file; it opens the file’s VirusTotal page in a new tab and records the view in the audit history. This sends the SHA-256 hash to a third-party service; do not use it when your policy forbids that.

Creating a file record is recorded as an import plus an edit. Replacing a file can create two edit entries. Deletion is recorded as a delete. A copy creates an export for reading the source and an import and edit for the new record. Copying a file name or visible details with the mouse creates no audit entry.

Sharing and bulk actions

In a writable vault, Select visible records selects only file records in the current search and filter. When all visible records are selected, the button becomes Clear selection. For a Viewer or in read-only mode this button is disabled; row checkboxes stay visible and files can still be selected one by one. Clear those selections by unchecking each row.

The file-screen bulk menu can include:

• Export selected writes record details to JSON after a confirmation and records an export for each record. For a file record this contains title, notes, and file details, not the file itself; it does not replace Download file.
• Assign category, Assign tags, Archive selected, Disable / revoke, Append note, Edit selected, and Remove with confirmation require a writable vault.
• Add to audit report writes only general record fields to CSV: title, type, source, status, risk, owner, category, tags, updated time, and directory fields that stay empty for files. It does not include file name, size, chunk count, SHA-256, or content.
• Run security check is not an antivirus or malware scan. File records have no copyable secret value, so this action does not scan file content.
• Import from Excel is the general record-template workflow, not a multi-file uploader. Use New file to add an encrypted file.
• Bulk share carries the selected records into Sharing. Nothing is sent until recipient, expiry, and use limits are confirmed there.

Internal sharing requires the Manager role on the active vault, the Owner or Admin role, and a writable license, and the selected files can total at most 1 GB. An external share package requires the Manager vault role and a writable license, and is also limited to 1 GB of files. In both methods, files are opened in the browser and encrypted again for the share; the original vault record does not become public.

Recommended workflows

Add a new encrypted file

1. Confirm the intended vault and the Editor or Manager role.
2. Check the file size, owner, and reason to keep it. Files does not show the exact remaining space, so leave room under the 1 GB limit.
3. Prepare the record with New file and wait for save progress to finish.
4. Check name, size, chunk count, and SHA-256 in the list.
5. Confirm the import and edit entries in Audit.

Download a file safely

1. Match the file name, size, and shortened SHA-256 to the expected record.
2. Choose Download file.
3. If no incomplete-file warning appears, move the download to an approved location.
4. When required, compare the SHA-256 locally and confirm the export entry in Audit. The entry proves the server handed out the file, not that the browser download completed.

Replace a file

1. Open the intended record with Edit secret.
2. Choose Replace file and check the new name, size, and chunk count.
3. Save the encrypted update without closing the tab during progress.
4. Check the new file with a test download and look for the edit entries in Audit.

Screen states

Before you act

• Confirm the correct server, vault, and file record.
• For create or replace, confirm your vault role is Editor or Manager and the license is writable.
• Confirm file ownership, retention and destruction expectations, related ticket, and file name.
• Check that the file is no larger than 1 GB. Because the remaining space is not shown, leave room under the limit.
• Apply your data-classification and retention policy before storing logs, database dumps, private keys, certificate bundles, or screenshots.
• Confirm that the download location, sharing recipient, and any third-party hash lookup such as VirusTotal are allowed by policy.
• Before replacement or deletion, confirm that any required recovery copy exists.

Safe evidence

• Safe to share: screen state, general error, rounded size, chunk count, role and license mode, and operation time with no confidential context.
• Keep private: file contents, full file name, full SHA-256 hash, record ID, owner or recipient, internal system or ticket link, vault name, notes, customer context, and local download path.
• When sending audit entries, redact the user, target ID, linked times, and integrity hashes as required.
• Never send raw logs, database dumps, private keys, signing material, installers, release archives, or unredacted screenshots, even to support.
• If a hash was sent to a third-party lookup, say so in the evidence; do not imply the file itself was uploaded.

When to stop and escalate

Stop if the expected file name, size, or SHA-256 changes; the file stays incomplete; encryption or upload never completes; a deleted record returns; your file space is unexpectedly full; an expected audit entry is missing; or the wrong file was downloaded, copied, or added to a share. Email support@vaultpilot.io without file content and include the screen state, redacted record ID, general size, chunk count, last safe step, time, and error text.

Operator notes

Files does not classify content, scan it for malware, or delete it when a retention period ends. VirusTotal hash lookup is only an external hash search. The operator remains responsible for data ownership, retention policy, a safe download location, and permanent deletion when required.

Related

• New record screen
• Sharing screen
• Audit Log screen
• Backups and restore
• Support evidence pack

Back to Documentation →