Case study
Designing a secure document delivery workflow for sensitive PDF content — with identity verification, personalized watermarking and complete download auditing.
CLIENT : CONFIDENTIAL
AI Technology
Model Evaluation Program
The problem
The client managed a collection of sensitive PDF documents that could only be accessed by registered users.
The existing requirement sounded simple:
Only registered users should be able to download a document, and every download should be traceable.
However, directly exposing the PDF files created several security and audit concerns. A conventional download link could potentially be:
The client therefore needed a controlled document-distribution workflow where every document request could be associated with a verified user.
What we built
Vincreda designed and built a dedicated Ruby on Rails application that acted as a secure document-delivery layer between the client's WordPress website and the sensitive PDF content.
Instead of allowing the browser to directly download the document, the workflow became:
01
Registered User
02
Identity Verification
03
OTP Verification
04
PDF Personalization
05
Email Delivery
06
Audit
Step by step
01
A registered user would access a sensitive document from the client's WordPress website.
Instead of receiving the PDF directly, the user would be directed into the secure document-request workflow.
02
The user's details were securely passed from the WordPress website to the Rails application through a controlled communication channel.
The application then requested the user's email address as part of the verification process.
03
An OTP was generated and sent to the user's email address.
The document could only proceed through the workflow after the user successfully entered the correct OTP.
This introduced an additional verification step before sensitive content was released.
04
Once the user was successfully verified, the Rails application processed the requested PDF.
A confidential watermark was embedded into the document along with contextual information such as:
User identification
Date
Timestamp
The objective was to make each distributed copy identifiable to the recipient and the point in time at which it was issued.
The user therefore did not receive the original unrestricted PDF. They received a personalized copy generated specifically for that request.
05
The generated PDF was then sent to the verified user's email address as an attachment.
This removed the need to expose the original PDF through a publicly accessible download endpoint.
06
Every document request was recorded within the Rails application. The audit trail captured the activity associated with document distribution, creating a record of:
requested the document
it was requested
occurred
the document was generated
it was delivered
This gave the client visibility into document access rather than simply relying on a web server's download logs.
The problem
CLIENT WEBSITE
SECURE USER /
REQUEST HANDOFF
SECURE PROCESSING LAYER
01
User verification
02
OTP validation
03
PDF processing & watermarking
04
Personalized document generation
05
Email delivery
06
Audit trail
The solution used a dedicated Rails application as the secure processing layer.
Problems solved independently
Building this before today's AI-assisted development ecosystem meant the implementation was designed through conventional software engineering practices, careful security thinking and iterative testing.
The project required solving several problems independently:
Authentication & verification
Ensuring the person requesting the document was actually associated with the registered account.
Secure system integration
Moving user information between WordPress and the Rails application without exposing sensitive information unnecessarily.
One-time verification
Using OTP validation to introduce an additional layer of identity verification.
Document transformation
Programmatically modifying PDFs and generating individualized copies.
Confidentiality
Ensuring the original document was not simply exposed through a direct browser download.
Auditability
Capturing enough information to reconstruct document-access activity later.
What it was built with
Ruby on Rails
WordPress
PDF Processing
OTP Authentication
Email Delivery
Secure API Integration
Audit Logging
What changed
The solution transformed a simple document-download requirement into a
controlled document-distribution workflow.
The client gained:
Confidentiality
Ensuring the original document was not simply exposed through a direct browser download.
Personalized documents
Every distributed PDF could carry recipient-specific identifying information.
Traceability
Document requests and deliveries were recorded within the application.
Reduced direct exposure
The original PDF was not simply exposed as a conventional public download.
A security-oriented workflow
Authentication, document processing and auditing were combined into a single controlled process.
The distinction that matters
Some software problems look deceptively simple.
But when those PDFs contain sensitive information, the real problem becomes:
Who is accessing the document?
How do we verify them?
What exactly did they receive?
Can we identify the copy later?
Can we prove when it was distributed?
This project was an example of designing the entire workflow around security and traceability, rather than treating document download as a simple file-serving problem.
And it reflects an important part of Vincreda's engineering philosophy: