Your clients' files deserve better than email

No. Your clients receive a secure link and can upload, download, or sign documents without creating an account or installing any software.

Every file is encrypted with AES-256 before it touches the disk. Structured data uses AES-256-GCM, and files use AES-256-CTR with HMAC-SHA256 and a unique initialisation vector per file. Even file names are encrypted. No one — not even us — can read your files on the server.

Yes. Add your logo, brand colours, and custom welcome messages to all client-facing portals. Your clients see your brand, not ours.

When a link expires or reaches its view limit, the encrypted data is permanently deleted from the server. Not archived, not recycled — deleted. Only a metadata record is kept for audit purposes.

Individual files can be up to 5 GB with resumable uploads. Transfers, exchanges, and e-signatures are unlimited on all plans.

Yes. Every subscription includes 3 team seats with role-based access — Owner, Admin, and Member — each with appropriate permissions.

Every new account gets a 7-day free trial of the full Vukorix Standard plan. To keep spammers and fraudulent signups out of the platform, we verify your payment method at sign-up with a USD $1.00 charge that is refunded to your card automatically — usually within a few hours, sometimes up to 5–10 business days depending on your bank. You won't be charged for the subscription itself until day 8. If you cancel before then, only the refunded $1 verification will appear on your statement. After the trial, the plan is $9.99/month per organisation; cancel any time.

Vukorix is designed with privacy regulations in mind — AES-256 encryption, mandatory 2FA, audit logging, and data minimisation. Vukorix gives you the technical foundations needed for GDPR, HIPAA, and similar regulatory frameworks worldwide.

Yes. Upload any PDF into Smart Forms. If your PDF already has fillable fields, Vukorix imports them directly with their original positions and types — a green confirmation banner shows when this happens. If your PDF is a flat scan with no embedded fields, AI vision detects the fields and you do a quick alignment pass before sending. Either way, attach the form to a Secure Receive or Exchange; clients fill it in online and you receive the flattened PDF back — no need to rebuild government forms, applications, or fact-finds in a separate form builder.

Every Vukorix email carries a unique 12-character verification code in its footer, formatted like VKRX-A7K2-9PMR-XJ4F. Anyone who receives the email can paste that code at app.vukorix.com/verify — a public page that needs no login — and see exactly who we sent the email to, which organisation triggered it, what type of email it was, the original subject, and the date sent. If any of those don't match the email the recipient is holding, the email is fake or tampered. If the code can't be found at all, the email isn't from us.

Phishers can clone our emails almost perfectly — the logo, the wording, the display name. What they can't do is replicate our HTTPS domain (app.vukorix.com) or fabricate a valid verification code. Codes are generated server-side and bound to the exact recipient, sender, and subject at the moment of send. If an attacker copies a real code into a forged email, the /verify page will show the real recipient and subject — which won't match the phishing email they sent. The trust anchor is the URL in the address bar, not anything inside the email.

Open app.vukorix.com/verify in your browser, paste the code from the email footer, and click Verify. The input accepts the code with or without dashes — it's not case-sensitive. If the code is genuine, the page shows the bound recipient address, the organisation that sent it, the type of email, the subject, and the date issued. Codes are valid for 90 days. The /verify page is rate-limited to protect against brute-force attempts, so you don't need to do anything to stay safe — just check before you click.

Yes. Every file passes through the built-in Warden virus scanner before it becomes downloadable. Infected files are blocked and quarantined, and both sender and recipient are notified — so you never pass malware to a client by accident, and you never receive it into your account.

Timestamps for every signing event, the signer's IP address, signer identity details, and a cryptographic hash of the signed document — proving the file has not been altered since it was signed. The certificate is downloadable alongside the completed document and is admissible as evidence of intent to sign.

Yes. Every account supports TOTP-based two-factor authentication with recovery codes, compatible with Google Authenticator, Authy, and 1Password — plus passkey (WebAuthn) support for passwordless sign-in with Face ID, Touch ID, Windows Hello, or a hardware security key.

API access is planned for a later release. If integrations with your practice management, CRM, or accounting tool are a priority, contact [email protected] — we can share current roadmap status and prioritise requests from trial customers.

Native AcroForm import is the primary path: if your PDF already has fillable fields, Vukorix imports them directly with their original positions and types. AI vision is the fallback for flat scanned PDFs without embedded fields — the model detects every fillable field automatically and you can adjust them visually before sending.

Three options on every share: None (open the link and go), PIN (enter a code you set), or SMS (one-time code sent to a phone number you specify). Pick per share so high-stakes documents get stronger checks without making low-stakes shares painful.

Yes. SMS verification can be enabled on Secure Share links, Secure Receive portals, and Secure Exchange sessions. The recipient receives a one-time code by SMS on the phone number you specify; the code expires quickly and is single-use. SMS is available in selected supported countries.

A team seat is a person who can sign in to your Vukorix organisation. Every plan includes 3 team seats. The organisation owner is on the house and does not consume one of the included seats — you start with 3 working users plus the owner.

Extra seats are $2.99 USD per seat per month. The owner adds them explicitly with a simple +/− stepper on the Billing page; pending invites reserve a seat so you never get a surprise bill. Stripe is only updated when you confirm the change.

The Help Assistant lives inside the app and guides you through workflows — explaining features, walking you through setting up your first Secure Share or Exchange, and offering a "Show me where" guided spotlight that highlights the right button. It can also escalate to a support ticket if you need a human.

No. The Help Assistant only reads product metadata — page names, button labels, and your settings — to guide you through Vukorix. It does not have access to the contents of any file you upload or send.

The Activity / Organisation Oversight page is visible to the owner and admins only. They can see who did what, recipient events, team-member activity, and document access events. Members do not see commercial seat detail or other team members' private activity.