Legal · Security
AspisFile Viewer
For IT and security teams
Everything needed to review the viewer for deployment or allowlisting: publisher identity, installer checksums, the endpoints it contacts, and a plain explanation of the behaviours an endpoint-protection product will observe.
What the application is
AspisFile Viewer is a desktop application for opening documents that have been shared with the person using it. Documents are never written to disk in readable form: pages are rendered server-side into image tiles and displayed in the viewer, so there is no decrypted file for another application to read.
It is a recipient-side reader. It does not scan the machine for documents, index the filesystem, or transmit anything about the device beyond the session and integrity signals described below.
Publisher and code signing
Developer ID Application: Panageotis Georgeou (37M8KCP95L)signtool verify /pa /v AspisFile-Setup.exe.Installer checksums
Every release publishes a checksums.txt containing SHA-256 for each installer, generated by the build pipeline rather than by hand.
Download checksums.txt for the current release →
Verify with shasum -a 256 <file> on macOS, or Get-FileHash <file> -Algorithm SHA256 in PowerShell.
Network endpoints
The viewer contacts two hosts, both over TLS:
No telemetry or analytics services, no advertising networks, and no third-party crash reporting are contacted. The viewer opens no listening ports and runs no background service — it runs only while the user has it open.
Behaviours an EDR product will observe
The viewer enforces document protection locally, which requires operating-system calls that also appear in unwanted software. Each is listed here with its purpose and scope so a reviewer can judge it rather than infer it.
1. The window is excluded from screen capture
SetWindowDisplayAffinity(WDA_EXCLUDEFROMCAPTURE) on Windows and NSWindowSharingNone on macOS. The document appears black in screenshots, recordings and screen-sharing. This applies only to the viewer's own window; no other application is affected, and no system-wide capture policy is changed. The same APIs are used by password managers and banking applications.
2. Running process names are checked for recording tools
While a document is open, the viewer periodically checks whether a dedicated screen recorder (OBS, Loom, Snagit, Camtasia and similar) is running, and blanks the document if one is. It reads process names only — not command lines, not environment variables, not process memory, not file paths. It does not run at launch or while idle, and it takes no action against any other process. Video-conferencing applications are deliberately not matched.
3. A URL protocol handler is registered
The aspisfile:// scheme and the .afs file type are registered so that a link in an email opens the viewer. On Windows this is written under HKEY_CURRENT_USER — per user, no machine-wide change.
What the viewer does not do
- No kernel driver, no system extension, no process injection or API hooking.
- No background service or scheduled task; nothing runs when the app is closed.
- No listening network ports.
- No modification of, or exclusion request against, security software.
- No packing or obfuscation of the binary.
- No keystroke logging, screen scraping, or capture of anything outside its own window.
- No scanning or indexing of the user's files.
Deployment options
AspisFile.pkg — signed and notarised; installs to /Applications.AspisFile.msi — per-machine install to Program Files, suitable for Intune, SCCM or Group Policy.AspisFile-Setup.exe — installs under the user's profile; no administrator rights and no elevation prompt. This is the default for recipients.AspisFile-Portable.exe — the raw signed binary, for locked-down machines that block execution from the user profile. Writes nothing outside the user's profile and registers the aspisfile:// handler for the current user on first run.All three Windows artifacts are signed. Each is published at aspisfile.com/downloads/ alongside checksums.txt for the release.
Data handling
Documents are encrypted before leaving the sender's device. The decryption key is split, and the recipient's copy is held as ciphertext that is useless on its own. Revoking access destroys the key material, after which the recipient's copy can no longer be decrypted by anyone.
To be precise about the current boundary: the server decrypts transiently at render time in order to produce page tiles. AspisFile is therefore able to render a document while it is live. Moving that step inside a hardware enclave is planned but not yet shipped, and we do not claim zero-knowledge today.
Questions
For allowlisting support, a security questionnaire, or to report a false-positive detection, contact hello@aspisfile.com.