Delivering to Clients

Once a report is final, you deliver it through a signed link. The client opens it in their browser — no account, no login. You track every view and can revoke access at any time.

Why signed links

Emailing a PDF is the traditional approach. It has problems:

• The PDF lives forever in the client's inbox
• You can't tell if they opened it
• You can't revoke access after sending
• There's no record of who viewed what

A signed delivery link solves all four. It's a URL that:

• Expires on a date you choose
• Tracks every view
• Can be revoked instantly
• Renders the report live, always up to date

Creating a delivery link

Open a report. In the sidebar, find the Deliveries card.

Click Create delivery link.

Choose an expiry:

• 30 days — for immediate review
• 60 days — standard
• 90 days — extended access

Click Create.

The raw URL is shown once. Copy it immediately. It will not be shown again — the system stores only a hash, and cannot regenerate the URL.

If you lose the URL before copying it, revoke the delivery and create a new one.

What the client sees

The client opens the URL in any browser. They see:

• The report in your branded layout
• Full interactivity — scrolling, TOC, code highlighting
• A footer with your company branding and the report version
• No login prompt, no account, no email required

The page loads fast — it's a server-rendered view, not a PDF.

View tracking

Every view is recorded:

• Timestamp
• IP address (if available)
• Count of total views

The Deliveries card shows each delivery with:

• Token prefix (first 8 characters — enough to identify, not enough to use)
• Status: active, expired, or revoked
• Created date
• Expiry date
• View count
• Last viewed timestamp

Click a delivery to see the full view log.

Revoking a link

To revoke a delivery before it expires, click Revoke on the delivery item. Confirm.

The link stops working immediately. Anyone who tries to open it sees "Link revoked."

Revoked links remain in your records — you can see when they were created, when they were revoked, and how many times they were viewed before revocation.

Expiry

Expired links behave the same as revoked ones — they show "Link expired" when opened. Expiry is enforced on every request based on the stored expiry timestamp.

You can't un-expire a link. Create a new one if you need to extend access.

Security of delivery links

The URLs are cryptographically random:

• 256 bits of entropy
• Base64url encoded
• Only the SHA-256 hash is stored server-side
• Verification uses constant-time comparison

This means:

• Brute-force guessing is impossible
• Timing attacks are prevented
• If your database is leaked, the raw tokens are not

Delivery for different report types

Every report type can be delivered the same way:

• Pentest reports
• Forensics reports
• IR reports
• Compliance assessments
• Purple team reports
• Attestation letters
• Retest reports

The template determines what the client sees. The delivery mechanism is identical.

Managing multiple deliveries per report

A single report can have multiple delivery links. Useful for:

• Sending to different stakeholders at different times
• Giving a reviewer temporary access
• Replacing a lost link without revoking the original

Each delivery is independent — separate URL, separate expiry, separate view log.

What happens when a report is updated

Delivery links always render the current version of the report. If you edit a report after sending the link, the client sees the updated content on their next view.

This is intentional. The link points to "the report", not "the report as it was at this moment."

If you need to freeze the report, generate a new version — the old version's deliveries continue pointing at the old version.

Removing a delivery

To clean up old deliveries, revoke them. They stay in the list but stop working.

Full deletion is possible from the delivery detail view. Deleting removes the record entirely — you lose the view log.

Where to go next

• Generating reports — creating the report
• Invoicing — billing the client
• Your first engagement — the full workflow