Once you send a file, you lose control of it.
LiveVault turns sensitive media into a tokenized link you still control: set how many times it can be opened and when it dies, then let it delete itself.
No account needed for the demo. Upload an image, get a link, watch it expire.
Secure. Tokenized. Temporary.
Share URL
https://share.livevault.live/v/7Fq2mXk9Lp4RtVn6BzHd8Gj3Cw5Ae0Yi2Os
- Views left
- 1
- Expires in
- 14:52
- Device
- Desktop only
- On expiry
- Media deleted
How it works
Four steps, and the link is gone
What a recipient experiences, from opening the link to the moment it stops existing.
Validate secure token and detect device
The token is checked against its hash, its deadline, and its remaining views. Device type is resolved before anything is revealed.
Desktop session starts and locks usage
One session per link. It is bound to the browser that opened it, and a second browser is refused while it is live.
Reveal assets one by one without previews
Nothing is shown up front. Each asset unlocks only after the previous one is complete, and the API enforces the order.
Destroy or expire link after secure completion
The link ends when its views run out, its deadline passes, or a restricted action trips it. Media is then deleted from storage.
Who it's for
Built for controlled disclosure, not storage
This is not a Dropbox or a WeTransfer. There is no shared folder and no permanent link — the point is that it disappears.
Photographers and agencies
Send unreleased shoots to a client for sign-off without the files living on in an inbox after approval.
Legal and HR teams
Share a recorded interview or scanned exhibit with a named reviewer, with a deadline and a record of who opened it.
Creators and pre-release review
Let a small group see a cut before launch. One view each, and the link is dead before it can circulate.
Anyone who currently just emails the file
Email and DMs give you no control after send. This gives you a deadline, a view budget, and a delete guarantee.
Security
What actually enforces the rules
Every control below is implemented in the API rather than the browser, so it cannot be bypassed by editing the page.
Tokenized links
256 bits of entropy per token, stored only as a SHA-256 digest. A database leak yields no working links.
View limit and hard deadline
Both are enforced on every request. Whichever runs out first ends the link, and an unopened link still expires.
Session-bound media access
Media is streamed through the API behind a short-lived ticket tied to one session. There is no shareable file URL.
Deterrence, recorded
Devtools shortcuts, print-screen, and leaving the viewer are reacted to and written to an audit trail.
Admin approval workflow
The first account bootstraps the system. Every account after it stays pending until an existing admin approves it.
Deletion, not just revocation
Expiry schedules a purge. A background worker deletes the objects from storage, then removes the record.
What this does not do
LiveVault cannot prevent screenshots or screen recording in a web browser. It deters casual capture, reacts to suspicious behaviour, and records what happened. The Security page explains exactly where the limits are.
Infrastructure
What it runs on
The real stack, named accurately. Nothing here is aspirational.
Render
ComputeThe Node.js and Express API runs as a long-lived service. No media is stored on the container filesystem, which is ephemeral.
MongoDB Atlas
DatabaseStores link records, viewer sessions, admin accounts, and the audit trail. Share tokens are stored only as SHA-256 digests.
Cloudflare R2
Object storagePrivate bucket holding uploaded media. Nothing is publicly readable; the API streams bytes only after validating a session.
Netlify
FrontendServes this server-rendered Next.js site, the public demo, the viewer, and the admin panel.
Early access
No customer logos here yet
LiveVault is pre-launch. There are no paying customers, no testimonials, and no case studies, so there are none on this page. What there is instead is a working demo you can try in about thirty seconds, and a changelog showing what shipped and when.
Want to be an early user?
Email me directly. There is no waitlist form because there is no waitlist software — it is just an inbox I read.
Who builds it
Saifullah Faizan
Founder
I build and ship products end to end — and LiveVault is no exception. There is no agency behind this and no team to hand the hard parts to, which is exactly why the security model is written down plainly rather than gestured at.
Founder and core developer
Every layer of LiveVault is written by one person: the Express API, the MongoDB schema, the media storage, the session-based viewer, and this site.
Multiple products shipped to production
Not prototypes. Several separate products run on their own domains and infrastructure, each built and deployed end to end.
IIT Roorkee certified in data science
Alongside a final-year BCA at NSHM Knowledge Campus.
Ships the whole stack
Frontend, API, database, object storage, DNS, CI and hosting — including the deployment pipeline this site runs on.