Katkat
Back

Design a Secure PDF Data Room

HarveySoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

Design an enterprise-grade virtual data room (VDR) for secure legal document sharing, focusing on multi-tenant access control, instant permission revocation, dynamic watermarking, and tamper-evident audit logging.

Scenario

Legal teams and corporate clients use Virtual Data Rooms (VDRs) during M&A due diligence, litigation, and regulatory audits to securely share thousands of highly sensitive PDF documents across organizational boundaries. You are tasked with designing the core backend architecture for a secure PDF Data Room platform.

Requirements

Functional Requirements

  1. Data Room & Asset Hierarchy: Support multi-tenant access across Organizations, Data Rooms, Folders, and Documents (PDFs).
  2. Granular Authorization: Support role-based and attribute-based permissions (e.g., Room Admin, Collaborator, View-Only, Watermarked-Only) with immediate access revocation.
  3. Secure Document Delivery: Prevent raw file exfiltration. Support dynamic, user-specific watermarking (e.g., embedding user ID, timestamp, and IP address) and secure page-by-page rendering in the browser.
  4. Audit Logging: Maintain an append-only, tamper-evident log capturing every access event (document opened, page viewed, download attempted, permissions changed).

Non-Functional Requirements

  1. Latency: Sub-second initial page render latency for documents up to 500 MB.
  2. Security & Isolation: Zero data cross-contamination across tenants. Cryptographic isolation at rest and in transit.
  3. Consistency: Revocations and permission updates must take effect within 1 second globally.
  4. Availability & Reliability: 99.99% read availability for active due-diligence rooms.

Scale & Capacity Assumptions

  • Total Tenants: 5,000 enterprise organizations; 50,000 active data rooms.
  • Storage: 50 million PDF documents. Average document size is 25 MB; maximum size is 500 MB.
  • Throughput: Peak traffic of 10,000 concurrent active reviewers, generating ~2,000 document/page requests per second and ~500 audit log events per second.

Key Areas to Cover

  • Authorization Architecture: How permissions are evaluated, cached, and immediately invalidated when permissions change.
  • Document Processing & Serving: How raw PDFs are ingested, rasterized or vectorized into secure tiles/pages, dynamically watermarked, and streamed to the client.
  • Data Model: Schemas for tenants, rooms, access control lists (ACLs), documents, and audit trails.
  • Audit & Compliance Pipeline: Ingestion and storage strategy for high-volume, tamper-evident audit logs.
  • Trade-offs: Direct storage download vs. reverse-proxy delivery; client-side vs. server-side watermarking.

Hints

Hint 1

Consider decoupling the raw PDF storage from the viewer by pre-processing documents into encrypted page tiles or SVG streams at ingestion time.

Hint 2

Pre-signed URLs are difficult to revoke instantly; evaluate session-bound reverse proxies or short-lived tokenized ticket mechanisms for document delivery.

Hint 3

For the audit trail, consider using an append-only log backed by write-optimized storage (e.g., Kafka into ClickHouse or an immutable ledger) to handle high-frequency page view events without impacting primary database performance.

Follow-up questions

  • How would you detect and deter automated scraping if an authorized reviewer scripts headless browser sessions to capture every page via screenshot?
  • If an enterprise customer demands customer-managed encryption keys (BYOK/CMEK) at the individual data-room level, how does that impact ingestion and full-text search indexing?
  • How do you ensure zero-downtime consistency and low latency for permission checks across multiple geographic regions?