Your files. Your key.
Connect your key vault, and the encryption Filetable applies at rest — to your original files, emails, exports and secure fields — hangs from a key that never leaves it. You set its rotation and how long it may be cached; your vault logs every use; revoke it, and none of it opens.
Coming soon. Talk to us to hear when it opens for your workspace — or to tell us how you would use it.Talk to us
What Filetable encrypts, under one key of yours.
Your key wraps a key for the workspace; the workspace key wraps the key of every file, email, export and secure field. Revoking yours closes them all; rotating it rewrites a single key.
And what it doesn't
The text read from your documents and the values of ordinary fields stay in your workspace's database, where they can be searched, filtered and edited — encrypted at rest by our hosting provider, in Switzerland. To seal a value, make its field secure.
Secure fieldsSoonYour files' encryption, under a key you hold
- 1
Connect your key vault
Point Filetable at a key in your own key management service. It is granted wrap and unwrap, nothing more: the key itself never leaves your vault.
- 2
Set rotation and cache
Rotate on your schedule — every 90 days, yearly or on demand: Filetable re-wraps one workspace key and re-encrypts no file. Choose how long an unwrapped key may stay in memory.
- 3
Keep the switch
Every unwrap appears in your vault's own audit log. Revoke the grant and, once the cache runs out, nothing your key covers can be opened — backups included.
What you get
Keep the key Filetable's encryption at rest depends on in your own key vault: set its rotation and cache, see every use, revoke it at will. Coming soon.
A kill switch you hold
Revoke the grant from your own console and the files stop opening: no request to us, no ticket, no waiting on a provider.
Your audit trail
Each use of your key is logged by your vault, in your logs, next to everything else your security team watches.
Your rotation policy
Rotate when your policy says. Your key wraps a single workspace key, so a rotation takes seconds and nothing stops.
An exit that really ends
Destroy the key when a contract ends, and every file it covers turns unreadable — in the backups too.
Platform features work around the whole cycle: they secure, explain and set up every stage, from the moment a document arrives to the action it calls for.
Used in
Frequently asked questions
Does my own key stop Filetable from reading my documents?
No — no service that reads documents for you can promise that. Filetable opens a file to read it, preview it and extract its values. Your key decides whether it can: your vault records each use, and once you revoke it and the cache runs out, no file opens.
What if our key vault can't be reached?
Work goes on while the workspace key is cached, for the time you set. Past that, files can't be opened or processed until your vault answers again. A key you destroy, though, is gone for good: keep it backed up in your vault.
Why do companies want their own key?
Because their security policy says who holds the keys. Banks, insurers, fiduciaries, health and public bodies often require that a provider reaches their data only with a key the company controls — one they rotate on their own schedule, watch in their own logs and can cut off themselves.
