Secure data exchange for a zero-trust world
SFTP, FTPS and cloud storage were built for a different threat model.
MnemoShare replaces static credentials and standing access with identity-bound, ephemeral exchange — fully auditable, Kubernetes-native, and designed for modern compliance.
Most breaches don't involve stolen disks. They involve valid credentials.
Designed to support audit and compliance evidence
MnemoShare helps teams produce defensible evidence around access, authentication, transfer activity, and administrative actions — without relying on long-lived credentials or opaque appliances.
Compliance answers shouldn't stop being true after a breach
Modern organizations still exchange sensitive data using patterns that assume perimeter trust, static endpoints, and long-lived secrets. That model breaks down the moment credentials are compromised
— which is how most incidents actually happen.
The Challenge
- ×
Long-lived credentials (SSH keys, service accounts) become permanent attack surface
- ×
Standing access accumulates over time (vendors, ex-employees, shared accounts)
- ×
Legacy transfer systems weren't designed for today's threat landscape
- ×
Audit trails are often incomplete, hard to export, or not evidence-grade
The MnemoShare Solution
- ✓
Identity-bound exchange — access tied to real users/services via SSO/OIDC and mTLS
- ✓
Ephemeral credentials — short-lived JWTs instead of permanent keys
- ✓
Policy-driven control — approvals, lifecycle rules, and automated enforcement
- ✓
Auditable by construction — immutable event logs designed for investigations and compliance
Security controls built for modern audits — and modern breaches
Everything is designed to reduce credential-based risk, enforce least privilege, and produce evidence-grade audit trails.
Protect data in transit and at rest
AES-256-GCM encryption at rest and TLS 1.3 in transit. SHA256 checksums verify file integrity. Client-side encryption options available for end-to-end protection.
- End-to-end encryption mode
- Integrity verification
- Secure key management
Structured Audit Events
Every security-relevant action generates a structured audit event. Export to customer-managed WORM storage and/or your SIEM for compliance and investigations.
- Operational visibility + evidentiary export
- WORM storage support (S3 Object Lock)
- SIEM integration
Identity Provider Integration
SSO via OIDC and SAML with Azure AD, Okta, Ping, and more. MFA enforcement across all access. TOTP available as fallback.
- SSO/OIDC/SAML
- MFA enforcement
- TOTP fallback
Least Privilege Access Control
Role-based permissions with scoped access at per-collection and per-workflow levels. Domain-based exceptions for trusted partners.
- Admin, User, Guest roles
- Scoped access policies
- Domain whitelisting
High-Throughput Transfers
Designed for high-throughput transfers with parallelism and resume. Direct multipart streaming to S3 with zero memory overhead.
- Parallel chunked transfers
- Zero memory overhead
- Instant resume on failure
Verification and Approvals
Approval workflows and recipient verification before file access. Time-bound access with automatic link expiry.
- Custom validation questions
- Approval workflows
- Time-bound access
Content Scanning and Quarantine
Real-time malware scanning via ClamAV/ICAP before storage. PHI/PII detection module identifies sensitive data with auto-quarantine option.
- ClamAV + YARA rules
- PHI/PII detection
- Auto-quarantine option
Native Outlook Integration
One-click secure send directly from Microsoft Outlook. Automatic PHI detection warns users before sending sensitive attachments via email.
- One-click secure send
- PHI detection warnings
- No end-user training
Hardware-Backed Identity
Non-exportable private keys bound to hardware security modules. Supports YubiKey PIV, macOS Secure Enclave, Windows Hello TPM 2.0, and Linux TPM.
- FIPS 140-3 ready
- NIST 800-63B AAL3
- Enterprise+ tier
When data must move — and security must be provable
Built for organizations that exchange sensitive data and answer hard questions.
Regulated Partner Exchange
- PHI/PII transfers: Share patient records, claims data, and member information with identity verification at every step
- Vendor onboarding: Secure ongoing file drops without permanent credentials or standing access
- Claims and billing: Exchange billing documents, authorizations, and financial data with full audit trail
- Clinical research: Transfer trial data and patient consent forms with configurable retention
Secure Client Deliverables
- Financial documents: Share loan documents, portfolios, and compliance reports with time-bound access
- Insurance packages: Transfer policy documents, underwriting data, and claims with recipient verification
- Tax and audit: Share tax returns, financial statements, and audit reports securely with clients
- Legal discovery: Exchange sensitive documents with chain of custody and immutable logs
The Modern Alternative to Legacy File Transfer
We removed the two most exploited components in enterprise file transfer:
permanent SSH private keys and vulnerable monolithic MFT appliances.
What You're Replacing
- ×
SFTP with 10-year-old RSA keys
Permanent credentials that accumulate and can't be revoked across deployments
- ×
FileZilla / WinSCP clients
Desktop apps with no audit trail, no SSO, and stored credentials
- ×
MOVEit, Accellion, classic MFT
A class of legacy MFT appliances that has experienced repeated high-impact vulnerabilities in recent years
- ×
Home-grown WebDAV portals
Memory-bound, single-server architectures that can't scale
MnemoShare Advantage
- ✓
Zero long-term credentials anywhere
Short-lived JWTs + optional mTLS with hardware-bound keys
- ✓
Modern web UI + Outlook add-in + CLI
SSO integration with Azure AD, Okta, Ping — enforced MFA everywhere
- ✓
Modern, minimal attack surface
Designed to reduce the blast radius of vulnerabilities — horizontally scalable with no monolithic components
- ✓
Zero memory overhead, true horizontal scaling
Direct multipart streaming to S3 — no single point of failure
RFP-ready: "We exceed SFTP public key requirements with short-lived certificates + MFA + JWT, eliminating the permanent private key problem entirely."
Flexible Deployment, Your Infrastructure
Self-hosted solution integrates seamlessly with your existing technology stack.
Storage Options
- AWS S3
- Google Cloud Storage
- MinIO (on-premises)
- Any S3-compatible
Database Support
- MongoDB 6.0+
- PostgreSQL
- Replica sets
- Encryption at rest
Deployment
- Docker containers
- Kubernetes/Helm
- Multi-cloud ready
- CI/CD compatible
CLI for Automation and Power Users
Cross-platform CLI supports Windows, macOS, and Linux. Available via Homebrew, APT, and Chocolatey package managers. See our documentation for the deployment guide
Modernize how your organization exchanges sensitive data
Replace legacy file transfer with an identity-first, zero-trust exchange platform built for today's risks and tomorrow's audits.
Questions? Email us at sales@mnemoshare.com