Skip to content
Coastal data, kept safe.
Pontile
VideoProtocolRequest a demo
Security

Encrypted in your browser. The keys stay with you.

Pontile is built so that Coste360, which runs the service, cannot read your documents. Here we explain how, what we do see and what Pontile cannot do.

Request a demo What we can and cannot see
  • Encrypted in the browser
  • Servers in Italy
  • For concessions, ports and tenders

How it works

Encryption, in plain words.

Every document is locked on your device. The key never reaches our servers.

  1. On your device

    The file is readable, as always.

  2. In your browser

    Content and name are encrypted before they leave.

  3. On the servers in Italy

    We store only unreadable data, without the keys to open it.

  4. At the people you invite

    Their browser holds the section key and opens the file again.

The keys, step by step

  • Your password

    From your password and a recovery key that only you keep, the browser derives your personal keys.

  • One key per section

    Each section of a hub has its own key, handed encrypted only to its members.

  • Encrypted before it leaves

    Content and the names of files and folders are encrypted in the browser; the server receives them unreadable.

  • Signed by whoever acts

    Invitations, uploads and revocations are signed: a compromised server cannot add a member or forge a document.

Transparency

What we can and cannot see.

To run the service the server has to know some things. Here is the list, plainly.

We can see

  • your email address and those of the people you share with
  • who is a member of which hub and section, with which role and until when
  • how many files and folders there are and how large they are, encrypted
  • the dates of uploads, openings and logins; IP addresses, for no more than 30 days
  • the dates and recipients of reminders

We cannot see

  • the content of documents
  • the names of files, folders, sections and hubs
  • comments and the text of deadlines
  • the details of the audit log
  • for organizations: client names and notes, templates, request contents and outcomes, rejection reasons

Always generic emails

The emails we send (reminders, document requests, nudges) are always generic: they never contain the names of hubs, files or clients.

You and the people you invite read the content. We keep data we cannot open.

Verifiability

Something to check, not just to believe.

What you can already check yourself, and what we will publish before launch so that others can check it.

Already in the product

  • Key fingerprints

    Compare a person’s fingerprint before sharing; your device warns you if their keys change.

  • Key transparency log

    Users’ keys go into an append-only log with signed roots: a hidden substitution becomes detectable.

  • Chained, signed audit

    Every hub event is signed and linked to the previous one; the browser checks the chain.

  • Pinned app version

    The browser accepts only app updates signed by Coste360 with a key kept offline.

Our commitments

Made, not yet delivered: they stay marked like this until they are done.

  1. Before launch

    App code published

    The client that runs in the browser, cryptography included, published as source-available: that is where encryption happens, and where anyone will be able to verify it.

  2. Before launch

    External security audit

    An independent review, with published results.

Where data lives

Servers in Italy.

The service, the database, the encrypted file storage and the backups are in data centres in Italy. There too, documents are stored only encrypted.

  • Serversthe service the app talks toItaly
  • Database and filesencrypted data and the information listed aboveItaly
  • Backupssafety copies, encrypted as wellItaly

Limits

What Pontile cannot do.

No encryption protects against everything. These are the limits, stated up front.

  • A compromised device

    If the computer of a reader is infected, whoever controls it sees what the user sees.

  • A member who copies

    Anyone with access can download a document and forward it. Revoking access does not delete copies already made.

  • Lost password and recovery key

    If you lose both, your data cannot be recovered: Coste360 holds no copy of the keys.

  • The information listed above

    Emails, memberships, sizes and dates are needed to run the service and remain visible to the server.

  • Availability

    Encryption protects confidentiality; it does not guarantee that the service is always reachable. That is what backups are for.

Comparison

Pontile and a traditional Drive.

We compare Pontile with standard Google Drive: personal accounts and the most common Google Workspace plans. Where Drive does more, we say so.

FeaturePontileGoogle Drive
Who can read the documentsOnly the people you invite: files, names and comments are encrypted in the browser and the keys stay with the users.Files are encrypted in transit and on the servers, but Google manages the keys, so it can technically access the content.1
Where the data isServers, database, file storage and backups in Italy.In Google’s data centres; the user does not choose the country where the files are stored.2
Access to parts of a caseSections with their own keys and members: whoever handles the tender cannot read the technical part.Sharing by file and folder, with roles such as viewer, commenter and editor: separation relies on server permissions, not on different keys.
Delivering without readingDeposit role: the supplier uploads to the section but cannot open the documents, not even their own.No sharing role for uploading without seeing the folder; a form with file upload, for example, is used instead.
Revoking accessThe server blocks access at once and the section keys change: whatever you upload afterwards cannot be read by whoever left.Remove the person from the share and access stops; the keys, managed by Google, do not change.
Who you are sharing withKey fingerprints to compare with the person; your device warns you if they change.You share with an email address: there are no fingerprints to check.
Activity recordSigned, hash-chained audit log, verified by your browser.Recent activity on files and, in the Workspace editions that include them, audit logs for administrators, kept by Google.
Requesting documents from clientsRequest templates, an outcome for each document (Approved or Rejected, with the reason) and progress across all clients.Not a Drive feature: it is organised with shared folders, email or forms.
Email notificationsAlways generic: no file, hub or client names.Sharing emails include the file name; comment emails usually include the text as well.
Editing and searchPreview in the browser, no online editor. The server cannot search inside documents, because they are encrypted.Built-in editors for documents, spreadsheets and presentations, previews of many formats and search inside file content. Here Drive does more.
Forgotten passwordYou get back in with your recovery key; if you lose that too, the data cannot be recovered.Account recovery through Google (recovery email or phone, or the administrator). Here Drive is simpler.
AvailabilityIn development, in the browser; desktop and mobile apps later.Available today, in the browser and with desktop and mobile apps.
  1. The Google Workspace Enterprise Plus, Education Standard and Education Plus editions offer client-side encryption, enabled by the administrator with an external key management service. It is not available for personal accounts or the most common plans.
  2. Google Workspace data regions (for example United States or Europe) are available only in some editions and are set by the administrator.

Comparison based on Google’s public documentation as of October 2026.

Google Drive and Google Workspace are trademarks of Google LLC. Pontile and Coste360 S.R.L. are not affiliated with Google.

For technical readers

For those who want the details.

Only standard primitives through well-tested libraries (libsodium or equivalent implementations), no home-made cryptography. The protocol page sums up keys, primitives and limits; with the release we will publish the code of the app that runs in the browser, where encryption happens, so that anyone can verify it.

Read the protocol

Questions about Pontile security?

We are happy to talk, with your IT consultant too.

Talk to the Coste360 team FAQ