Folio is DocSend-grade document sharing with far deeper analytics — HMAC-signed links, 47+ data points per view, and trusted-IP bypass. Yours, on your own infrastructure.
No credit card · Multi-tenant from day one · Runs entirely on Cloudflare Pages + D1
Upload, tokenize, share, and watch — every capability you'd expect from an enterprise data room, on infrastructure you control.
Generate human-friendly links like apex-node-4821 instead of opaque hashes. Set max-uses, expiry dates, and attach any document — each link is independently revocable in one click.
Recipients open a clean, your-logo viewer — no login, no friction, no download leakage.
See opens the instant they happen — recipient, location, device, and dwell signals.
Send signed links straight to recipients with branded transactional email built in.
Three tiers — Super Admin, Admin, and Viewer — so your whole team can manage documents and read analytics without sharing one password.
Every document, token, and log is scoped to a workspace. Run separate brands or clients from a single deployment with zero data bleed.
DocSend tells you "someone viewed it." Folio captures 47+ signals on every open — geography, network, device, and client environment.
Cryptographically signed links, owner-IP bypass, and hardened auth — so your documents can't be forged, replayed, or guessed.
Every share URL carries an ?sig= HMAC-SHA256 signature. Tampered or hand-crafted links are rejected at the edge with a timing-safe comparison — guessing a token is useless without the workspace key.
Whitelist the creator's IP plus up to five reviewers. Their opens never hit the access log and never burn a max-use — preview your own decks without polluting recipient analytics.
Admin passwords use PBKDF2 derivation; sessions are HttpOnly, Secure, SameSite-Strict cookies scoped to /admin. The signing key never leaves the server or appears in any API response.
No infrastructure to provision, no SDK to wire up. Sign in and start sharing in minutes.
Drop in an HTML deck or document. It's stored encrypted in your own D1 database — never on a third party's servers.
Create a memorable, HMAC-signed token per recipient. Set usage limits and expiry, then copy or email it directly.
The moment a recipient opens it, 47+ data points land in your dashboard — who, where, on what, and how often.
Sign in to the admin console and create your first signed, tracked link in under five minutes.