The review-before-send layer for AI-generated work
Send the work your AI made. Not what came along with it.
SendFrame shows you exactly what your customer will receive, removes what should never leave the building, and delivers it to named people who verify their email. No public links, ever. Works with output from Gamma, Claude, Copilot and other AI tools.
Deployment ROI — Northwind
deployment-roi-northwind.pptx · 11 pages
Access key on page 7
AKIA…MPLE matches an AWS key format. Removed from what your recipient receives.
Internal link on page 3
wiki.yourcompany.internal/q3-pricing. Your call.
Scanned against known malware signatures
No match. The original is untouched.
I've read the findings that need attention and want to send this anyway.
Sending to 3 named recipients. Each verifies their email before anything renders.
SendThe problem
Your AI made the deck in three minutes. Your name is on the email.
The tools got very good at making things. A QBR, a renewal proposal, a working ROI model, a dashboard your customer can click through. Three minutes, and it looks like a week.
What the tools are not good at is knowing what should stay inside your company. The model saw your internal wiki, so it linked to it. It saw a colleague's name in the thread, so it thanked her on slide nine. It saw a credential in the context, so it put it in a footnote. It left a hidden text block from an earlier draft. None of that is malice. All of it goes out with your name on it.
SendFrame is the thirty seconds between "it's done" and "it's sent."
- So the choices today are
Open it and eyeball it.
Twenty pages, a customer waiting, and the thing you will miss is the thing that matters.
Export to PDF and attach it.
Now it is forwarded, indexed, and out of your hands forever.
Paste a public link.
Now it is in a Slack channel of forty people you have never met. Or in a search engine: shared AI conversations and artifacts from three major tools were indexed by Google in the last thirteen months.
Ask security.
Now it is next Thursday.
How it works
Three steps. The middle one is the product.
Upload
Drop in a deck, a document, a spreadsheet, a PDF, an image or an HTML artifact. Or have your agent POST it straight from the workflow that made it.
Review
SendFrame scans the file against known malware signatures, then flags credentials, internal URLs, colleague names, personal data, hidden text and prompt-injection phrasing, each one with where it is. You see exactly what your recipient will see. High findings are removed from what goes out. Everything else is your decision, on the screen, with the evidence in front of you.
Send to names, not to the internet
Name your recipients. Each gets their own link and verifies their email with a one-time code before anything renders. You see who opened it, when, and what they did inside it.
What the review screen catches
The things that ride along.
Every finding shows you the exact page and the exact text. Nothing is hidden behind a score.
What we do not say: that we catch everything. Detection is pattern-based over text we can reach. It does not read images, and it cannot know that "Project Falcon" is confidential. You are still the decision-maker. Our job is to make that decision informed instead of blind.
Hidden text
White-on-white, off-canvas, zero-size, collapsed blocks from an earlier draft. Invisible to you, present in the file, and readable by any AI your customer points at it.
Prompt-injection phrasing
Text written for an AI reader, not a human one. Hidden instructions in documents have driven a recipient's assistant to hand over data with no click; if that text is in your file, you want to know before your customer's assistant does.
Credentials
API keys, tokens, signed URLs, connection strings: in the body, in a footnote, in the notes.
Internal URLs
Wiki pages, staging hosts, intranet links your customer should not even know exist.
Colleagues' names and personal data
The people your AI saw in the thread and decided to mention. Names are matched against your own team, so the screen is not a wall of false alarms.
Speaker notes and file properties
Reported, not alarmed: they do not reach the recipient, and you would still rather know they were there.
The wrong recipient
If three of five addresses are inside your own company, the screen says so before you send, and rescores the rest accordingly.
Redaction
Removed means removed. The original is never touched.
Most tools draw a black box over the thing. The thing is still in the file, under the box, and it reaches the browser. SendFrame removes a redacted finding from the bytes we serve. It is not there to find.
The original is never modified. Redaction is a decision stored beside the file, and what your recipient gets is derived from it. So a wrong flag destroys nothing, you can reveal a finding after sending and hide it again, and each change takes effect on the next visit without touching the source.
For everything but HTML the honest word is withheld: a page still carrying a flagged finding is not shown at all, and the recipient sees a labeled placeholder saying so.
And you do not have to believe us.
One API call returns exactly what a verified recipient receives, produced by the same function the viewer calls. Your security team can grep the bytes themselves.
# what the recipient actually gets
GET /api/v1/shares/{id}/delivered
# is the key in there?
$ grep -c "AKIA" delivered.html
0
Delivery
Every recipient is a name that proved its email.
There is no public link on SendFrame. Not a setting you turn off, an absence: there is no code path that produces one.
Your recipient knows.
Every viewer page says, plainly, that viewing is shared with the sender. We think a customer who learns later that they were watched is a customer you lose, so we say it up front.
One link per person, behind a one-time code. Nothing renders until the address on the invitation has been verified.
Revoke one person, not everyone. Access is per recipient, so you pull one link without disturbing the rest. A revoked link says nothing about what it used to be.
Forwarded links give nothing away. Pasted into Slack, Teams or iMessage, a link previews as "Sam at Halcyon Advisory shared a document with you," never the title, never a page.
Download and print are your call, per document. Both default off. When on, a download is exactly what the recipient is served, redactions and all, never the original file.
You know who opened it because they verified, not because you tracked them. We never store a raw viewer IP address, and we keep no location for a viewing at all: a coarse device class, and a name that typed a code.
Interactive
If your AI made something that works, it still works when it arrives.
Working ROI models. Explorable dashboards. Proposals that recalculate when the customer changes an assumption. Two years ago these did not exist; now every AI tool makes them, and every way of sending them turns them back into a picture.
SendFrame delivers interactive artifacts in a sandboxed viewer with state that persists per recipient. You see what they changed, and when, with their name on it. That is not a page-view metric. That is intent, on the record.
Deployment ROI — Northwind
Opened by priya@northwind.example
Priya changed ramp from 4 to 6 months
Her numbers are still there when she comes back on Monday.
Security · lives at its own URL
Written for the person who has to say yes.
Send this section to your security reviewer. It is the reason SendFrame exists, not a badge at the bottom of the page.
Recipients are verified, not guessed. Every recipient gets their own link and confirms their email address with a one-time code before anything renders. There are no public links.
Tenant isolation enforced at the database with row-level security, verified by a cross-tenant zero-rows test on every CI run.
Malware scanning before conversion. Uploads are scanned against known malware signatures (ClamAV), and a file that matches is refused. It is never delivered to a recipient. Samples are never sent anywhere.
Redaction removes, it does not cover. The bytes we serve do not contain a redacted finding, and the original is never modified, so what you redacted and when stays auditable.
Sandboxed execution for interactive content, served from a different registrable domain than the one your team signs in to.
No raw viewer IPs, ever, and no location. A coarse device class is all we keep about the device. We know who viewed because they verified their email.
Retention you can state in one sentence. Artifacts are kept 180 days on the free plan and indefinitely on paid plans. Who opened a document, when, and which pages is kept for 12 months, then deleted.
You do not have to take it on trust. One API call returns exactly what a verified recipient receives, produced by the same function the viewer calls.
What we do not claim. We do not hold a SOC 2 report. We do not claim to detect malicious content, only files that match known signatures. We do not claim that nothing sensitive can leave. The whole product is built on the sender still being the one who decides, with the evidence in front of them.
Read the security overviewFor agent builders
Make "send it" a tool call.
Most agent stacks end at "email it": a raw attachment, or a human-approve step that someone will eventually switch off. SendFrame is the other option. Your agent produces the artifact; SendFrame delivers it in the same loop, scanned, redacted and attributed, with or without a human in the middle.
When nobody is present, findings are redacted by default and a person can reveal them afterwards, per finding. Anything a recipient writes back is marked as theirs before your agent reads it. A retried send never mails a recipient twice.
A REST API and an MCP server, on every plan, including free. Connect it from Claude with OAuth, or from anything else with a key.
POST /api/v1/artifacts → upload
POST /api/v1/artifacts/{id}/process → scan and review
POST /api/v1/artifacts/{id}/share → deliver to named recipients
{ "sent": 3, "redacted": 1, "withheld": 0 }
Who it's for
Built for the person whose name is on the deliverable.
Consultants, fractional executives and boutique firms
Who ship client work every week from Claude and Gamma, whose prompt context is full of other clients, and whose clients have started asking how AI is used.
Customer success and account managers
Sending QBRs and renewals that an AI drafted from an account history full of things the customer should not see.
People building agents
Whose output has to reach a client without a human in the loop, and who need "send it" to be a tool call that is safe unattended.
Sales teams under security constraints
Who keep rebuilding live models as static decks, because that is the only thing legal will approve.
RevOps and enablement leads
Who rolled out the AI tool and now have to answer for what leaves the building: the Team plan's policy layer and the findings log are for the questionnaire that is coming.
Why SendFrame and not something else
Seven things that are true here and not elsewhere.
Review is the first step, not a feature.
Everything else in this category starts after the file is already out: who opened it, how far they scrolled. SendFrame starts at whether it should go out at all.
Safety is never an upsell.
Verification and redaction are on the free plan and the $25,000 plan. Everyone else puts security behind an Enterprise call. We think that is backwards, and we priced accordingly.
Neutral by design.
Works with output from Gamma, Claude, Copilot and other AI tools. When your AI stack changes next quarter, and it will, the send layer does not.
No public links. Not a setting, an architecture.
There is no code path that produces one.
The original is never modified.
Redaction is a decision beside the file, so a wrong flag destroys nothing and what you hid stays auditable.
The API is on every plan.
Including the free one. Sending should be a tool call, not a tier.
Interactivity survives the send.
No other way of getting this out of your building keeps it working.
Pricing
Priced so security isn't the thing you cut.
Every plan includes verification, redaction and the API, the free one too. What you pay for is capacity, seats and organization-level controls, never the thing that keeps you safe. Recipients and viewers are never seats, however many there are.
$99/ month, locked for life
First 15 customers. 10 seats, everything in Team.
Claim a founding seat15 of 15 remaining$15K/ year, from
Invoiced. SSO and a contract. Audit export, retention controls, badge removal.
Talk to usIdentity verification and redaction, every plan. Verified recipients, the review screen, redact-on-send, revocation, containment, malware refusal.
API and MCP access, every plan, send scope included. An agent-operable product whose API is an upsell is a demo.
Questions we get
Straight answers.
- Does the recipient need an account?
- No. They get an email and a one-time code. That is the entire experience on their side. At sendframe.app they can also see everything currently shared with their address, after verifying it.
- Isn't this built into the AI tool already?
- Every generator can share its own output, from its own domain, with its own idea of who is looking, which is usually "anyone with the link" or "people in your workspace" and nothing in between. None of them looks inside the file before it goes out. SendFrame does not care what made the artifact. It checks it, delivers it to named people, and stays put when you switch tools.
- Will it actually find anything in my files?
- That depends on how the file was made, and the honest answer is that some scan clean. The ones that do not are the ones you wanted to know about: the key that was in the prompt, the wiki link, the colleague's name, the text block nobody can see. Check a file, free and with no account, and find out on your own last deliverable before you decide.
- Isn't this just DocSend?
- DocSend tracks who scrolled through a static document. SendFrame starts one step earlier, at the question of whether the document should go out at all, and then delivers a working artifact and tracks what the recipient did inside it. Different jobs. Plenty of teams will run both.
- What happens when the review finds something?
- High-severity findings are removed from what the recipient receives before the link goes out. Everything else is shown to you with its location, and you decide. SendFrame never refuses a send over content; it asks you to acknowledge it. The only things that never go out are integrity failures: a malware match, a file that could not be processed, an empty document.
- Can I change what's hidden after I've sent it?
- Both directions. Reveal a finding or hide it again, and the next visit serves the change without touching the original. When you hide something you had revealed, SendFrame tells you who opened the artifact while it was visible. Opened, at session level; nothing can say whether they read it.
- Can I revoke access after sending?
- Yes. Per recipient, so you revoke one person without disturbing anyone else, or the whole share at once. A revoked link previews as unavailable and says nothing about what it used to be.
- Can recipients download or print?
- Only if you allow it, per document, and both are off by default. A download is exactly what the recipient is served, redactions included, never the original file.
- How long do you keep things?
- Artifacts are kept 180 days on the free plan and indefinitely on paid plans. Who opened a document, when, and which pages is kept for 12 months, then deleted. We never store a raw viewer IP address.
The artifact is the deliverable now. Look at it before it leaves.
Thirty seconds of review. Named recipients. A record of who opened it.