Secure share

Secure share lets you hand a secret (a password, PIN, licence key, config snippet or URL) to someone outside OpsMerge using a link that destroys itself after a set number of views or a time limit, whichever comes first. It replaces emailing credentials in plain text.

Zero-knowledge by design

The secret is encrypted in your browser before it is sent. The decryption key travels only inside the link itself and never reaches our servers, so OpsMerge cannot read what you share, and neither could anyone who got hold of the database. The trade-off: if the link is lost it cannot be recovered, and you cannot re-open a share to see what you sent. That is deliberate.

Creating a share

1. Open Secure share (or use the lock button in a ticket reply, see below).
2. Type or paste the secret, and optionally a label so you can recognise it later in your list. The label is for you only; the recipient never sees it.
   • Need a password? Use Generate a password. Choose Memorable for a word-based passphrase (pick the number of words, a separator, optional trailing digits, and capitalisation, e.g. Otter-River-Brave-4821) or Random for a random string of a chosen length with upper/lower/digit/symbol classes. Generation happens in your browser using a cryptographically secure random source.
3. Choose how many times it can be viewed before it burns (1, 2, 5 or a custom number up to 100) and how long it lasts (1 hour, 24 hours, 7 days, 30 days or custom). These start from your organisation's defaults.
4. Create the share and copy the link. Send it to the recipient however you like.

Once created, the link is the only way in. Send it over a channel the recipient already trusts.

What the recipient sees

Opening the link shows a page confirming the link is live and warning that revealing it uses one of its views. When they choose to reveal, the secret is shown once and, if that was the last view, the link burns immediately. An expired, burned or already-used link shows only "link unavailable", with no hint of what it held.

The recipient needs no account and nothing to install; the page works in any modern browser.

Your branding

If your organisation serves the client portal on your own custom domain, share links are issued on that domain automatically and the reveal page carries your logo and colours, so the whole exchange stays white-labelled. Otherwise links use the platform's standard secure-share host.

Sending a secure link from a ticket

When replying to a ticket, use the lock button in the reply toolbar. It opens the same create dialog and drops the finished link straight into your reply, so you can send a client a temporary password without it sitting in your mailbox.

Managing and revoking

The Secure share list shows every link your organisation has created, with a status of active, burned or expired. You can revoke an active link at any time, which burns it instantly. You cannot see the secret itself from this list, only its status. Every creation, reveal and revoke is recorded in the audit log.

Defaults

Admins set the organisation's default view count and expiry from the Defaults button on the Secure share page. These pre-fill the create dialog; anyone creating a share can still override them per link.

Permissions

• secure_share.create — mint links (granted to Admin and Technician roles by default).
• secure_share.manage — view the organisation's list, revoke links, and edit the defaults (Admin only by default).