File protection and document workflows for businesses
Your team can work on their own Windows computers. iGet creates a protected workspace for company documents and blocks unauthorised copying outside it. You decide who has access and which approvals they need.
An application on employee computers. Your server and data in your infrastructure.
Three layers of protection: from server to drive
What is iGet?
iGet protects and shares company files. It connects an application on employee computers to a management panel in your infrastructure. Add case workflows and further capabilities as your team needs them.
Employees use company documents. iGet blocks unauthorised copies outside the protected workspace.
02 /Requests, owners, approvals and deadlines. See whose decision a case is waiting for.
03 /A Windows application and a server you host. Your company manages access.
01The problem
Channels iGet can close
Traditional DLP tries to recognise content and guesses whether it is a leak. iGet doesn’t guess: a program that read data from the protected drive cannot write it anywhere else — whatever the file name or format.
02iGet in everyday work
01 · Working with files
Install iGet on an employee’s Windows computer. The team uses company folders and documents on an encrypted workspace drive. Employees keep familiar applications; your company sets access rules.
02 · Preventing copies
Saving a protected company document to the desktop or a USB drive is blocked. The administrator also defines policies for clipboard, printing and network connections. Protection applies to data from the protected drive.
03 · The right access
Choose who can view, download or edit a document. Permissions depend on the role, folder and confidentiality level. Permission to work does not have to include permission to send files outside the company.
04 · Document workflows
The Case Workflow add-on connects requests, tasks and approvals. Assign owners and deadlines. An approval can grant access or change classification, and the decision history keeps the reasons.
Files, permissions and processes. In one system.
Add-on / Case workflow
Does a document need approval from a manager and then another reviewer? The Case Workflow add-on guides it through defined stages, with clear responsibilities and a decision history.
Select a document and explain what you need.
Tasks go to assigned people or roles, with deadlines and escalation.
A process can grant access, change classification or anonymise a document.
See who decided, when and why.
03Try it yourself
This is what working with iGet looks like: documents open normally, and an attempt to take data out ends with one clear message — not a flood of notifications.
Z: · Protected drive
Destinations
Drag a file onto a destination, or select a file and click a destination.
A browser simulation — this is how the iGet app behaves.
04Permissions
One axis instead of a thicket of exceptions: a role is attached to a folder and grants a specific set of actions at each classification level. Levels are a set, not a ladder — a role can cover levels 1 and 3 while skipping 2.
Role
Folder /Sales
Role “Sales rep” in folder /Sales — allowed actions: 16, of which with identity confirmation: 2.
brak_uprawnienia
The role does not reach this folder
request to the folder owner
poziom_poza_uprawnieniem
The role does not cover this classification level
request to extend the role to this level
czynnosc_poza_rola
The role does not cover this action
request to add the action
sufit_poziomu
Nobody may perform this action at this level
no request will help — only reclassification
wymagane_potwierdzenie
The operation needs fresh proof of identity
confirm with your key and try again
Additional verification for selected operations on confidential files.
05Identity confirmation
Sending outside the organisation, copying to removable media, anonymising, purging from the repository or downloading a highly classified document all require fresh proof of identity. The proof is single-use and valid for 120 seconds.
06Platform
The protected drive and the driver are the foundation. Around them is the rest of working with documents: the team, sending, mail, events and updates.
Check-outs and versions
Team documents appear in Explorer as ghost files with their real names. You check them out for editing or reading, and returning one creates a new version. Previewing without downloading carries the viewer’s watermark.
Outside the company, under control
The link goes by one channel, the code by another. An external recipient decrypts the file in the browser, and for an internal recipient the server decides at every opening. Expiry date and download limit.
Before you click “Send”
An add-in for classic Outlook for Windows checks a message before it is sent: domains, extensions, attachment classification and numbers such as PESEL, NIP or IBAN. An attachment above the sender’s permissions can turn into a link for internal recipients.
No driver replacement
You assemble a new blocking rule from blocks in the panel and test it on recorded events before it reaches workstations. A rule can only add a block — never remove one.
Review queue
A series of denials collapses into one row with a counter, and the “For review” queue puts critical matters at the top. An alert arrives once per event, not once per denial.
Signed history
The administrator decides whether and for how long a person may work without the server — from one minute to 72 hours. When time is up, the service closes applications and removes the drive, and the history from that period is signed and cannot be edited.
Workstation register
iGet app releases carry a manifest signed with an Ed25519 key that the server does not store. The service checks the signature, certificate and checksum before installing anything.
Add-on Managed passwords
Personal and team vaults encrypted on the client side. An entry remembers which program and domain it may be typed into, and managed passwords let people sign in without ever learning the password.
Add-on Decisions with justification
Requests, approvals, deadlines and escalations. An approval can automatically grant access, change a classification or anonymise a document, and the justification stays in the case history.
07Deployment
iGet is installed in the customer’s infrastructure: a server with the administration panel and a PostgreSQL database, plus the iGet app on Windows workstations. Documents do not travel to someone else’s cloud.
How it works
Windows · iGet application · protected drive
↕ Synchronisation and permissions
iGet server · documents · administration panel
One process, one department, 20–30 workstations. We test the policy on real work, not on slides.
Server installation, roles and folders, classification levels and the workstation protection policy set in the panel.
The iGet app, system service and driver on Windows 10 and 11 computers. Working drives are created for users.
Event queue, alerts, workstation register and decision history — in one panel, in Polish and English.
08Compliance
iGet does not replace a lawyer or a certification. It provides the technical measures required by NIS2, the amended Polish National Cybersecurity System Act (KSC) and the GDPR — and a trail showing that those measures work.
Access control and multi-factor authentication, incident handling through the event queue and alerts, protection of workstations against data exfiltration, signed software updates.
Access limited by folder and classification, anonymisation and metadata removal as controlled actions, a log of access to documents, encrypted working drives.
Every refusal has a reason, every exception an expiry date and a justification, and the history of offline work is signed. “Who, when and why” is answered by the panel, not by the administrator’s memory.
This description of features is not legal advice or a certification of compliance.
09FAQ
No. Documents live on an encrypted drive that looks like an ordinary drive letter and open in the same programs as before. The only thing that changes is where data from that drive can go.
On a server in your infrastructure and on the encrypted working drives of the workstations. iGet does not require the vendor’s cloud. If you use YubiKey OTP codes, they are verified by the Yubico service by default.
At the operating-system kernel level, iGet stops data from the protected drive from being written to the desktop, Documents, USB media and cloud folders and, depending on policy, also blocks new network connections, program launches and printing. The clipboard, screenshots and keyboard shortcuts are handled by the iGet app based on kernel decisions. Keystrokes are not recorded.
Closing, shutting down or attacking the iGet program immediately cuts off access to the encrypted drive, and if the system service disappears, the driver seals the volume at once. This protects against an ordinary user; accounts with operating-system administrator rights call for procedures we discuss during deployment.
Yes, if the administrator allows it: for selected people they set a window from 60 seconds to 72 hours. When it ends, the drive is removed, and the signed, non-editable history of offline work reaches the server once the network is back.
The working drive is always encrypted. For private files synchronised with the server there is a workstation-side encryption mode in which only the user knows the key recovery code. The team repository is encrypted on the server with AES-256-GCM.
Yes, with classic Outlook for Windows. The add-in checks a message before it is sent, and replacing an attachment with a secure link works for internal recipients.
Workstations running Windows 10 and 11 (x64). The server runs in your infrastructure with a PostgreSQL database. The panel and the iGet app are available in Polish and English.
The Password vault and Case workflow are licensed separately. The licence is verified without an internet connection, and after it expires everything keeps working for 14 days — after that only writing is paused, while reading remains available.
With a demo built around one process from your company, followed by a pilot on 20–30 workstations. Write to us and we will set a date.
10Contact
Pick one process — contracts, HR, finance — and we will show how iGet protects it from the drive to the server.
Already have an account? Go to the panel →