Documents that move money, delivered exactly as sent.
Chain of custody for capital calls, wire instructions, closing documents and audit evidence. Each file is fingerprinted and encrypted in your browser before it leaves your computer, and only the recipients you name can open it. Their device checks every download against your fingerprint, and every open and download is signed, so both sides can prove what was sent, when and to whom.
3e81a7c4…9f02d6b5Anchoreda90c27d1…41e0b6f8Anchored5be17c09…af33d2e4AnchoredA changed account number, caught before the wire.
You send capital call notice 7 through a room on 3 March. The investor downloads it and their device confirms it matches your fingerprint. A week later an email in your name reaches the same investor with the same notice and a different account number. When the investor drops that attachment on the file's public proof page, it does not match. The room's log shows when the real notice was opened and downloaded, each entry signed.
3e81a7c4…9f02d6b53e81a7c4…9f02d6b5Matches your fingerprintb06c15e9…4a7d83f1Open a room and add the documents
One room per fund, deal, matter or client. Add the capital call, the wire instructions or the closing set. Your browser fingerprints each file, encrypts it with its own key and uploads only the encrypted copy. The fingerprint is recorded in the document ledger before the upload. File names are encrypted too.
Name the recipients
Each recipient gets their own link. The key that opens the files travels inside the link, in the part after the # that browsers never send to any server, so Invoance never sees it. Email the invitation through Invoance or copy the link and send it your own way. Set when access starts and ends, per room or per person.
They open with a code, download and check
The recipient asks for a 6-digit code, sent to the inbox you named. No account. A forwarded link opens nothing on its own, because the code goes to the address you named. Later visits can use a saved passkey. The file is decrypted on their device and compared with your fingerprint before it is saved.
Every step is signed
Room created, file added, recipient added, link opened, file downloaded, access refused, access revoked, policy changed. Each is a signed entry chained to the one before, and the room exports as an evidence package anyone can check offline.
- SHA-256 of the fileAnchored in the document ledger before upload
- AES-256-GCMFile and name encrypted, key locked per recipient
- Ciphertext + locked keysNo key that opens a file, no plaintext
- Decrypt, hash, compareSaved only if it matches your fingerprint
- Signed entryseq, prev_hash, Ed25519, exportable
| Who | The investor, counterparty or auditor you add by email. No account. |
|---|---|
| Sees | Who sent it, the room, the file names and the files, decrypted on their device and checked against your fingerprint. |
| Is refused | Before access starts, after it ends, after a revoke, or from a country outside the allow list. The refusal page gives no reason; the reason goes to the signed log. |
| Holds | Encrypted files, encrypted file names, locked room keys, each file's hash and the room's policy. |
|---|---|
| Never holds | A key that opens a file, or a readable copy of one. An invitation emailed through Invoance carries the link in transit, like any mail relay, and it is neither logged nor stored. |
| Keeps | The signed room log and every file's anchored fingerprint, append-only. Nothing in it is deleted. |
| Policy | How it is enforced | Note |
|---|---|---|
| Named recipients only | Only the people you add get a link, and the room key is locked for each of them separately. | No open links. A forwarded link works for nobody else. |
| Email code | Files and keys are released only after the 6-digit code sent to the recipient's inbox is entered. Resends and wrong tries are limited. | As strong as that inbox. |
| Saved passkey | A repeat recipient opens with a passkey on their device or in their password manager. A room can require one, so a code alone never opens it. | Holds even if the inbox is taken over. |
| Access start and end | Set per room or per recipient. Outside the window the server refuses the file and logs the attempt. | Files stay in the room and can be shared again. |
| Revoke | Their link stops working at once and their sessions end. You can also rotate the room key, so files added later use a key they never had; the remaining recipients get new links. | Cannot undo a download that already happened. |
| Country allow list | The server checks where the request comes from and refuses the rest. Each refusal is logged. | A control and an audit signal, not a guarantee. A VPN changes where a request appears to come from. |
- Each file's SHA-256 is anchored in the document ledger before upload, so the instructions you sent are fixed at that moment.
- Each entry in the room log is signed with your organization's Ed25519 key, numbered without gaps and chained by the hash of the entry before it.
- The recipient's download is checked against your fingerprint on their device before it is saved.
- Anyone holding a copy can drop it on the file's public proof page: match or no match, no account needed.
- The evidence package holds every entry, every file hash with its ledger anchor, the recipients and the public key, with instructions for checking it offline.
- Evidence Rooms do not move money, hold funds or check bank accounts. They make sure the document that arrives is the one you sent, and prove it. Your call-back and approval controls still apply.
- Our claim is that Invoance stores no keys and no readable files, not that reading is impossible. Encryption in the browser relies on the page code we serve.
- Anyone who can open a file can copy it, screenshot it or photograph the screen.
- No previews, watermarks, virus scanning or search on the server, because the server never sees a readable file. Recipients download files; nothing is shown in the browser.
- The email code is as strong as the recipient's inbox. A saved passkey, or a room that requires one, closes that gap.
- Country rules check where the request comes from, which a VPN changes.
- Lost passkeys together with a lost recovery key mean lost files. Setup asks you to store the recovery key offline for that reason.
Capital calls and distributions
Notices and wire instructions from fund administrators and general partners to investors.
Wire and payment instructions
Closing funds, settlement details and changed bank details, from title and escrow agents, law firms and suppliers.
Closing, KYC and audit documents
Subscription documents, identity packs and evidence for auditors and regulators.
Evidence Rooms
$59/ month
Files up to 100 MB each. Enterprise terms on request.
- Unlimited rooms, files and recipients
- 3 team seats
- 10 GB of encrypted storage
- Anchored fingerprints and the signed room log
- Access dates, country allow list, revoke, passkey requirement
- Email codes and saved passkeys for recipients
- Recipient pages on rooms.invoance.com
| +50 GB storage | $10 a month |
|---|
How does the investor know the document is the one we sent?
What does the recipient have to do?
Who can open a room?
What record do we have afterwards?
How does this fit our payment controls?
Do we need developers?
Send the next capital call through a room.
Rooms live in the dashboard. Recipients need no account.