Most people who receive an HOA document package will never have an account with us.
Title officers. Escrow. The agent. The lender.
So the link is the product.
Which means it has to behave like a parcel locker code, not a filing cabinet key.
Deliverables ship as "anyone with the link" URLs. No login, no invite, no password reset at 6pm on a Friday while a closing sits waiting. Forward it to whoever is actually doing the work.
But an open link is only safe if it's a narrow one.
So every share points at exactly one folder and nothing above it. You can retype the address all you like — climbing one level up doesn't hand you the next order's documents. It hands you nothing.
Then: expiry.
Every deliverable carries an end date, and it's enforced on the signed-in download and the public link alike — because a rule you enforce in only one place isn't a rule, it's a preference.
An expired link doesn't give you the usual "not found". The web has a more specific answer that means "this existed, and it is deliberately over." That's the one you get. Not ambiguity, not a dead page that looks like a bug. A clear ending.
Refunds are stricter still. Refund the order and the access dies with it. Same second. No nightly cleanup job, no "we'll rotate that link on Monday."
The practical bits:
→ staff can extend an expiry when a closing slips, which it does, constantly
→ admins keep access afterwards, because someone has to be able to answer what was delivered and when
→ downloads inside the app carry a tamper-evident seal — change one character of the address and it simply stops working
And the reason any of this exists: an estoppel is only true as of a date. A disclosure package still downloadable a year later isn't a service. It's a liability with a download button.
The previous expiry mechanism was hoping nobody forwarded the email.
Next act: what happens in the minutes after Pay — the machine that builds the package.