Different by construction.
The stored representation is an encrypted Blackline artifact, not a standing PDF or office document exposed for ordinary retrieval.
BL.00 / Controlled document transfer
Blackline
Send it. Receive it. Destroy it.
Blackline controls the movement of sensitive documents through an encrypted transfer environment. A designated recipient verifies access and initiates a single authorized handoff. That release triggers immediate destruction of the Blackline transfer artifact. The record of the transaction remains; there is no document restore.
Blackline / Operational oversight
BL.01 / Storage architecture
The document does not remain the document.
Blackline does not store a conventional document in a protected folder and wait for someone to download it.
Document content is transformed into an encrypted, system-controlled artifact. Its native document format is not the persistent storage representation. The encrypted artifact is maintained outside publicly accessible web directories and processed for release only through the authorized recipient path. Identical input documents have produced distinct encrypted artifacts in internal repeated-submission testing.
Outside the public surface.
The encrypted transfer artifact is kept outside public web folders. A direct document URL is not the access mechanism.
Access is an event.
Recipient verification precedes a controlled, one-time document release. Blackline is not a persistent sharing destination.
BL.02 / Custody doctrine
Control the handoff. Do not keep the copy.
A transfer has a purpose. When that purpose is complete, Blackline's possession ends.
The sender controls the source. Blackline holds an encrypted transfer artifact only until the designated recipient initiates its authorized release. The handoff triggers immediate destruction of the Blackline copy and closure of the access path. The receiving party is responsible for the released document; the custody event record survives.
01
Sender custody
The original document begins under the sender's control.
02
Controlled transfer
An encrypted artifact exists only for the defined transfer window.
03
Recipient custody
Following release, the recipient holds the document. Blackline does not retain a retrievable transfer copy.
One handoff. No second retrieval. A new request requires a new transfer.
BL.03 / Controlled release
One path from send to destruction.
Creation, encryption, notification, verification, one-time release, and removal belong to a single controlled transfer lifecycle.
BL.04 / Transfer procedure
Controlled at every transition.
The recipient receives a means to request access—not the file itself.
Blackline separates the transfer notice, access verification, document release, and closure into attributable events. Each stage has a defined purpose and boundary.
01 / CREATE
Assign the recipient.
The sender submits the document and creates a transfer record with the intended recipient and release context.
02 / PROTECT
Transform and isolate.
Blackline encrypts the content into a controlled storage artifact outside public web access. The document is not distributed as an email attachment.
03 / NOTIFY
Send the access path.
The recipient receives a transfer notification containing a route into the verification process, not a standing document link.
04 / VERIFY
Confirm the recipient.
A short-lived access code must be verified before Blackline authorizes release.
05 / RELEASE
Deliver once.
The recipient initiates a single authorized document release. This event is separately recorded before the system records artifact deletion.
06 / DESTROY
Close the transfer.
The authorized release triggers immediate deletion of the encrypted Blackline artifact and closure of its access path. Blackline records the deletion and transfer closure as separate events. There is no restore or repeat access to that transaction.
BL.05 / Custody audit
The document is destroyed. The record remains.
Destruction ends Blackline's possession of the content, not visibility into the transfer.
The sender can follow the transaction from creation and upload through invitation, observed access-link opening, access-code request and verification, release initiation, Blackline-copy deletion, and closure.
Each event is recorded with a timestamp and available actor, IP, source, and technical metadata. A sender-defined title provides an operational reference; document fingerprints may accompany applicable events. The record describes system-observed activity—not a claim of the recipient's physical location or independent proof that every downloaded byte was retained.
CUSTODY / CLOSED
What happened remains reviewable. What was transferred is not retained for another release.
BL.06 / Exposure reduction
Documents move. Copies accumulate.
The easiest way to send a document is not always an appropriate way to control it.
Attachments can remain in mailboxes, forwarded messages, synchronized clients, and archives. Shared-folder permissions and long-lived links may persist beyond the reason for disclosure. Blackline is built to minimize where its transfer copy exists, how long it remains available, and whether past authorization can be reused. Once the authorized release occurs, the Blackline copy is destroyed rather than held for a second attempt.
Not an attachment.
Notification and content are separated. The document is not included in the transfer email.
Not a shared folder.
The recipient does not browse a standing repository or maintain an ongoing access link.
Not a document archive.
Blackline preserves attributable transfer events while eliminating the transfer copy at closure.
BL.07 / Security posture
Zero trust applied to document transfer.
The authorized handoff is specific, observed, and final.
Blackline separates encrypted custody from recipient verification, and verification from release. A successful access-code check does not grant indefinite possession: the release path is used once, the Blackline artifact is destroyed, and later access requires a newly authorized transaction.
In an internal 85-submission exercise, identical source material produced 85 distinct encrypted artifacts. A later blind comparison of two same-source artifacts revealed no readable original content or recognizable native-file structure. These are observed test outcomes, not an independent cryptographic certification or a claim of resistance to every attack.
BL.08 / Controls
Policy-defined controls. No standing entitlement.
- Sender-controlled transfer creation, recipient designation, and sender-assigned titles
- Encrypted, transformed storage artifacts
- Storage outside public web directories
- Document-free email notification
- Short-lived recipient access codes
- Single authorized release; no reopening of completed handoffs
- Transfer expiration for unclaimed access
- Immediate transfer-artifact destruction triggered by authorized release
- Sender-visible event history, timestamps, actor and connection metadata, and applicable SHA-256 fingerprints
- Hosted and private deployment paths
BL.09 / Deployment paths
One doctrine. Different operating boundaries.
Blackline can provide a controlled hosted transfer point or operate inside an organization's own environment.
The governing lifecycle remains the same across deployments: transform and isolate the content, verify the recipient, authorize one release, destroy the Blackline artifact, and preserve the custody event record. Deployment location and operational responsibility are defined separately.
Quick Send
Aerellus-hosted
A controlled transfer path for mission-specific or occasional releases. The encrypted artifact temporarily resides in the Aerellus-operated Blackline environment and is removed when the transfer closes.
Private deployment
Client-controlled infrastructure
Blackline operates within the agency or organization's environment, placing transfer infrastructure and operational custody under the client rather than requiring Aerellus to intermediate the content.
Managed deployment
Private custody / managed support
The client remains the custody operator, with implementation, configuration, or technical support delivered under an agreed service arrangement and deployment boundary.
BL.10 / Applications
When the transfer matters as much as the content.
Legal and professional services
Release case materials, signed records, sensitive correspondence, and confidential client documents without introducing an email attachment.
Government and public sector
Support accountable transfer between authorized personnel and designated external recipients within the applicable deployment boundary.
Security and risk operations
Move incident records, assessments, compliance materials, and operational reports through a tracked release process.
Enterprise operations
Transfer confidential financial, governance, vendor, and leadership records where persistent shared access is undesirable.
Operational coordination
Release mission-support packages, time-sensitive administrative records, or controlled brief materials to designated personnel without establishing persistent shared storage.
Interorganizational handoffs
Provide a one-time release to a designated counsel, consultant, auditor, insurer, advisor, or other recipient.
BL.11 / Accountable closure
Destroy the transfer copy. Preserve the record.
Blackline distinguishes between a document and the evidence of its movement.
The sender can inspect the transfer record after its document artifact has been deleted. That record distinguishes recipient actions from system actions—including release initiation, Blackline-copy deletion, and final closure—without functioning as a source-document repository. This is the point of the architecture: account for the handoff without keeping a second permanent document repository.
Blackline does not restore a completed transfer for convenience. If the recipient loses the released document or requires access again, the sender creates a new independently authorized handoff. The sender and recipient remain responsible for content they retain outside Blackline.
BL.12 / Access
Establish a controlled handoff. Close it by design.
Blackline supports Aerellus-hosted transfer and private or managed deployment paths. Discuss the operating boundary, custody requirements, and release controls appropriate to your organization.