6.2M documents in custody/1.4M signatures executed/AES-256
Custody for documents
that matter.
A sealed vault with a signing desk attached. Deposit a document, release it with a key that expires, execute it in place when it has to be signed — and keep a hash-chained record that survives any audit.
- TLS 1.3
- SOC 2-aligned
- ESIGN · UETA
- GDPR-ready
- AES-256 at rest
- TLS 1.3 in transit
- SOC 2-aligned controls
- ESIGN · UETA
- M.G.L. c. 110G
- GDPR data rights
0.0M
Documents in custody
Across 3,100 organizations
0.0M
Signatures executed
ESIGN- and UETA-aligned
0.0%
Uptime, trailing 12 mo
100% on Enterprise
0%
Actions in the ledger
Hash-chained, append-only
K/02 — Custody chain
A folder holds a file.
A lock holds a position.
A folder holds a file.
A lock holds a position.
Everything CapitalKey does happens in three moves — and the key only ever turns twice.
- 01
Deposit
Drop a document into the vault. It is encrypted on arrival, versioned, checksummed, and filed against the matter or counterparty it belongs to. Nothing leaves as an attachment again.
AES-256 · versioned · checksummed
- 02First turn
Release
Cut a key for exactly one person and exactly one document or folder. View or download, for a set number of days, revocable the second you change your mind.
Named · time-boxed · revocable
- 03Second turn
Execute
When a document has to be signed, it is signed where it sits. The signer never receives a copy — they receive a key. What comes back is an executed original and a certificate.
ESIGN · UETA · certificate issued
K/03 — Capabilities
Six things a folder cannot do.
Six things a folder cannot do.
Every capability exists to answer one question an auditor, a regulator, or a counterparty will eventually ask: who had this, and when.
- K/01
Access keys, not links
A key is issued to a named person for one document or folder, with a permission and an expiry. There is no shareable URL to forward, and revoking is instant.
- K/02
Execution in place
Send a signature packet and the document stays in the vault. The signer opens it under their key, signs, and the executed original never becomes an email attachment.
- K/03
Hash-chained ledger
Every deposit, view, download, key, and signature is written to an append-only ledger where each entry carries the hash of the one before it. Gaps are visible by construction.
- K/04
Intake requests
Ask a counterparty for documents with a single secure request. What they upload lands in the right folder, tagged and logged, without touching your inbox.
- K/05
Retention and legal hold
Set a retention schedule per folder and freeze anything under hold. Disposition happens on schedule, is logged, and is defensible when someone asks who deleted what.
- K/06
Nothing left behind
No public objects, no permanent download links, no copies scattered through mailboxes. When a key expires, access ends — including for anything already opened.
K/04 — Security
Six pins. One line.
Then it turns.
A cylinder opens only when every pin sits on the shear line at once. Custody works the same way: identity, permission, expiry, and the record all have to agree before a document moves. If one is off, nothing turns.
- Tenancy
- Every row scoped to one organization. No shared buckets, no cross-tenant reads, enforced in the database rather than the application.
- Keys
- Short-lived signed URLs minted per open. Nothing in the vault is a public object, and an expired key cannot re-open a document already viewed.
- Ledger
- Append-only and hash-chained. A removed or edited entry breaks the chain at the next hash, which is what makes the export worth showing an examiner.
- Custody
- AES-256 at rest, TLS 1.3 in transit, per-organization key separation, and an on-premises key option on Enterprise.
- 09:14:02vault.depositSPA_SeriesC.pdfr.vanceprev 8f2c…a91dhash 04b7…e6f2
- 09:15:41key.issueview · 14d · m.okaforr.vanceprev 04b7…e6f2hash 1d90…77ac
- 11:02:18doc.openSPA_SeriesC.pdfm.okaforprev 1d90…77achash b6e1…2f08
- 11:09:53signature.executeSPA_SeriesC.pdfm.okaforprev b6e1…2f08hash 5aa4…c130
- 11:09:54certificate.issuecert #4471systemprev 5aa4…c130hash e07d…9b45
- 17:40:00key.expireview · m.okaforsystemprev e07d…9b45hash c3f8…0a61
Sample entries. In a live vault every row is written by the service role only, and no seat — including the owner's — can edit or delete one.
K/05 — Execution desk
Signing is the second turn — not a second product.
Step one
Cut the key before you send anything
Pick the document, the signer, and how long their access lives. Nothing is emailed — the signer receives a key to a document that never leaves the vault.
Signer
Key expires in
14 daysK/06 — Plans
Priced by what you keep, not per signature.
Box
A single practitioner with documents worth locking.
$34/ month
1 seat · 50 GB
- 25 access keys / month
- 20 signatures / month
- Hash-chained ledger
- Intake requests
- Retention rules
- Legal hold
- SSO / SAML
Vault
Most chosenThe working plan for a firm that signs every week.
$99/ month
5 seats · 500 GB
- Unlimited access keys
- 250 signatures / month
- Hash-chained ledger
- Intake requests
- Retention rules
- Legal hold
- SSO / SAML
Chamber
Regulated work, litigation exposure, and examiners.
$329/ month
20 seats · 2 TB
- Unlimited access keys
- Unlimited signatures
- Ledger export + attestation
- Intake requests
- Retention rules
- Legal hold
- SSO / SAML
Enterprise
Unlimited seats, a 99.9% uptime SLA, BAA, white-labelled execution pages, custom retention, and an on-premises key custody option.
All plans include AES-256 custody, the hash-chained ledger, and GDPR data rights. Prices in USD, billed to the organization, cancellable at any time with a full export.
AES-256
Documents encrypted at rest with per-organization key separation.
TLS 1.3
Every byte in transit, including signer sessions on the execution page.
SOC 2-aligned
Access, change, and monitoring controls mapped to the Trust Services Criteria.
ESIGN · UETA
Electronic execution under 15 U.S.C. § 7001 and M.G.L. c. 110G.
K/07 — On the record
What people say once the key has turned a few hundred times.
We stopped emailing executed agreements the week we moved. When opposing counsel asked who had seen the schedule, I exported the ledger and that was the end of the conversation.
Rachel Vance
Partner, Halloran & Vance
ChamberSigning inside the vault is the part nobody expects. The document never leaves, so there is no copy to chase down afterwards. Our retention policy finally means something.
Marcus Lin
General Counsel, Northrop Holdings
VaultI run a two-person shop and I still get keys, expiry, and a certificate on every signature. It costs less than the storage we were already paying for.
Priya Shah
Principal, Shah Advisory
Box
Questions
The eight we are asked first.
Anything else — including security review packets and DPAs — comes back the same day from a person, not a form letter.
In encrypted object storage scoped to your organization, in the United States. Objects are never public: each open mints a short-lived signed URL tied to a valid access key, and expired keys cannot re-open a document even if it was viewed before.
Open a vault
Give it a lock, not a folder.
Set up takes an afternoon. Your first deposit, first key, and first executed signature all land in the same ledger, and it starts on the day you sign up — not the day you migrate.
6.2M in custody · 1.4M executed · 99.9% uptime