Skip to content

Owner guide

A user with the manage own pdv vault permission manages their vault at /user/{user}/vault (the Vault tab on their user page). Everything here is doable in the browser.

Adding items

  • Add a document uploads a file, encrypts it, and stores it under a chosen kind. For a unique kind that you already have, tick Replace existing document to erase and replace the old one. Files appear under Files with View / Edit / Delete; View opens the decrypted file (images and PDFs in the browser, other types as a download), and the Edit form's filename links to the same view.
  • Add a record (one button per record kind) opens a form generated from that kind's fields. Records appear under My structured data with View / Edit / Delete; editing re-encrypts in place and keeps any grants you have already given.

Protecting your vault with a passphrase

Under Vault passphrase (in the Advanced section of your vault page) you can lock your vault behind a personal passphrase that only you know, so that not even an administrator can read your files and structured data. See Concepts for how it works.

  • Enabling it asks you to choose a passphrase and confirm it. From then on, opening your vault shows a locked banner until you Unlock it with that passphrase. The unlock then lasts while you keep using your vault and re-locks after a period of inactivity (how long is set by the site operator, and closing the browser locks it at once).
  • Changing the passphrase requires the vault to be unlocked first.
  • Disabling it requires your current passphrase, and returns the vault to the Master-KEK-only protection.

Warning

There is no recovery. If you forget your passphrase, your vault becomes permanently unreadable by anyone, including the site operator. While the vault is locked, a consumer you have shared with cannot read or write it until you unlock it.

Sharing

There are three ways a consumer ends up with access:

  • Grant access - you pick one of your documents or records and a consumer, and grant it directly.
  • Incoming requests - a consumer asked for a kind; you Approve (binding the request to one of your items) or Decline it. The Access column shows whether a request is for read or write. Some read requests arrive as a streamlined "trust this site" prompt that asks per kind rather than per item; it carries a Pick specific items to share instead link to the full item-by-item form if you would rather choose individual items.
  • Trust a consumer - a standing pre-authorization for a kind, so the consumer does not have to ask each time. See below.

Active grants are listed under Active grants and can be Revoked at any time.

Trusting a consumer

Add trusted consumer pre-authorizes a consumer for a chosen document or record kind, in one or both directions:

  • Read - the consumer may read any of your items of that kind, now and in the future, without a per-request consent. This is a broad, standing authorization; revoke it when no longer needed.
  • Write - the consumer may save items of that kind into your vault without the per-upload consent page. Write does not also grant read: tick both if the consumer needs to read your items as well as write them.

Each scope is a separate entry in Trusted consumers and is revoked independently.

By default a trust lasts until you revoke it. When you add one you can instead set an expiry (for example 30 days, 6 months or a year): once it lapses the consumer is asked for consent again. The same expiry choice appears wherever you grant ongoing access, such as the consent page for an incoming request.

Deleting (cryptographic erase)

Delete on any document or record destroys its key material, so the ciphertext becomes permanently unrecoverable, and removes any grants on it. There is no undo. See Concepts.

Acting on several rows at once

Every table on your vault page has a checkbox in front of each row. Tick the rows you want, then use the button below that table to act on the whole selection in one step:

  • Files and Structured data - Delete selected (a cryptographic erase of every checked item).
  • Active grants - Revoke selected.
  • Consumer access - Stop trusting the checked entries.
  • Access requests and Store requests - Decline selected. Approving stays one request at a time, because each approval is its own review of exactly what you are sharing.

A batch button leads to the same confirmation page as the matching single-row action, telling you how many rows it affects; nothing changes until you confirm.

Keeping your vault

A site may delete a vault that goes unused for a long time (data minimization). You are warned by email well before, and simply using your vault - logging in or opening it - resets the clock, so an active vault is never deleted. If you are stepping away, you can download a copy of your data first with the Download my data button on your vault page.