On this phone
Your file stays where it already is, so you don't end up with two of everything. It's sealed the moment you send it. Before that, it's as safe as your phone is — so if your phone is locked, so is your file.
Files
Your files stay on your phone.
Not on our servers. Not in a folder we could open if somebody asked us nicely. You add a file, you organise it, and when you send it to someone it travels sealed and then it's gone from the middle. There is no copy in between for anybody to ask about.
Coming with the iPhone app. Files is built and working, but it lives in the iPhone app, which hasn't been released yet. It isn't on Android at all yet either. So if you're on Android today, this is something to look forward to rather than something you can use.
Two ways to keep something
Because "private" means different things for different files.
A holiday photo and a signed contract don't need the same care, so you get to choose. Here's what each one gives you.
Encrypted
A locked copy inside the app, opened only by your passphrase. Someone holding your phone gets nothing readable. This is the one for the documents you'd mind losing — and you can move a file into it at any point, without hunting for it again.
You decide which
Most things don't need locking away, and pretending otherwise just fills your phone up. Add everything the light way, then encrypt the few that matter — one swipe, and the app tells you plainly that you'll then have two copies until you tidy up the original.
Labels
Every file says how sensitive it is.
A list of filenames tells you nothing about what you're about to send. Every file here carries a marking — how confidential it is, and which part of the business it belongs to — and it stays with the file when it travels, so it arrives filed the same way rather than landing in a heap.
It's written, not just coloured
The level is spelled out on every row. Colour helps you scan, but it's never the only thing telling you — nobody should be deciding whether a document can leave the building by remembering what amber meant.
It travels with the file
Send something and its marking goes too, so it lands under the same heading on the other phone instead of quietly becoming ordinary. The person receiving it sees what you saw.
Your own words
Levels and areas are whatever your organisation already calls them. Nothing here assumes a government scale, and a level we haven't been given a name for is shown as itself rather than guessed at.
Sending
To a person, not to a link.
We used to make share links. They worked, and the server genuinely couldn't read them — but a link is a key anybody can forward, and it has no idea what it's carrying. So we took them out.
Now a file goes to someone you've chosen, through the same encrypted channel as your messages. Before it sends, the app tells you who will be able to open it, in those words. That sentence is deliberate: a marking says how careful to be, and handing someone the file is you deciding they're allowed. Nothing further down the line will second-guess it, so the moment you tap send is the moment that matters.