Every copy of you
should expire.

The ask

“Just send me a copy of your passport.”

Nothing is wrong with the request. Marisol Vega needs to verify a tenant, and this is how it has always been done: attach the scans, hit send, get the keys.

Here is what that costs. The copy lands in an inbox Valeria does not control. It is backed up twice before she finishes her coffee, forwarded to a colleague for the paperwork, indexed by a mail client that will happily surface it in five years, and still sitting there when Barton Realty is sold to somebody neither of them has met. She cannot see it, cannot count it, and cannot take it back.

None of that is a security failure. It is simply what a copy is once it leaves you: a thing with no end.

What she carries

Identity isn’t one schema

Valeria is a Mexican citizen resident in Texas, which means she carries two countries’ paperwork and they agree about nothing. A CURP is not an SSN is not a SIN: different shapes, different issuers, different rules about who may even ask.

So Dossier does not offer her a generic text box. It seeds the fields each country actually uses, with its real format and a note on who is entitled to it. Fourteen fields, six documents, none of them mandatory. Delete any of it, add your own.

The seal

She releases four of fourteen

A letting agent needs a name, a national identifier, an address and evidence of income. She does not need a blood type, a passport scan, or the number of the account the rent comes out of. Under the old method she would have received all of them anyway, because a PDF cannot be partially sent.

• Legal nameReleased
• CURPReleased
• Address — Austin, TXReleased
• Proof of incomeReleased · 1 document
• Passport № · RFC · Blood type · +7 moreWithheld

Then a deadline, which is not optional. “No expiry” exists in the picker and is labelled as the exception, because a product whose entire claim is that copies end should make you go out of your way to make one that doesn’t. She gives it ten days.

The handover

A link is half of what they need

The link goes by email, because email is where the conversation already is. The six-digit PIN goes by text. That single split is the difference between a forwarded message being a breach and being a dead end: an inbox somebody else can read now carries half of what they’d need.

Someone else

At half past ten at night, from Phoenix

Somebody who is not Marisol Vega opens the link. It is impossible to say how they got it and it does not matter: this is the ordinary fate of a URL that has travelled through more than one person’s software.

They reach a PIN gate and nothing else. Not a field, not a document, not the recipient’s name, not the fact that a lease is involved. The attempt is written into the file and Valeria reads it in the morning. She did not have to be awake for any of it.

The other side

Marisol opens it, and isn’t asked to sign up

There is no navigation, no sidebar and no account to make. The recipient of a dossier is not a Dossier user, and pretending otherwise would be a lie about the product told at the exact moment it is being judged.

She gets four rows she can copy one at a time or all at once, because her actual job is getting these values into a form on another screen, and making her select text by hand would be the real design failure. One document. And the same countdown Valeria sees, not a softer version of it.

• Legal nameValeria Rosas Guzmán
• CURPROGV920714MDFSZL03
• Passport №••••••••
• Blood type•••

The redaction bars are not a permission check drawn as a lock. Those ten fields are not fetchable through this link at all; the bars exist so she can see the shape of what she was not given, rather than wondering whether she was given everything.

The trail

What they did, not that they “accessed” it

One minute later Valeria’s copy of the file has grown. Unlocked, opened, which field was copied, which document was viewed, every wrong PIN, and roughly where from. Marisol was told this before she typed the PIN rather than after, which is the only order in which telling her means anything.

Location is a timezone, not an address, unless the recipient opts into precise coordinates. Enough to notice an open from somewhere unexpected, and deliberately not much more.