Document access and evidence
A shipment document portal should preserve context when a file crosses an organizational boundary.
Evaluate a shipment document portal by asking who can open the file, what shipment and document identity remain visible, whether view and download are distinct, how access ends, what event evidence is retained, and how the portal fits the organization's recordkeeping policy.
By Ayhan Karaca, Co-Founder · Updated: August 21, 2026
What should a shipment document portal make visible?
A portal should show the intended shipment, document type or label, recipient role, and available action without exposing unrelated workspace data. Inline viewing and downloading are different decisions: viewing supports inspection in context, while downloading creates another copy that the recipient can store or forward under their own controls.
Under 19 CFR 163.4, the general rule for records required under the cited customs provisions is five years from entry or from the activity that required the record, with specific exceptions and different periods for some records. A portal does not determine which rule applies; it should support, not replace, the organization's record classification and retention process.
| Control area | Question to answer | Evidence to retain |
|---|---|---|
| Identity | Which shipment and document is this? | Stable label, reference, and source |
| Authorization | Why may this recipient open it? | Role or scoped action context |
| View | Can the file be inspected without an automatic download? | Successful or failed access event |
| Download | Is creating a local copy an explicit action? | Download event and document identity |
| End of access | When and how does authorization stop? | Expiry, revocation, or account rule |
| Retention | Which policy applies to the underlying record? | Classification, owner, and required period |
Keep access control and record retention separate
Access answers who may use a file now. Retention answers how long the responsible organization must keep a required record. A short-lived link does not authorize deletion of the source record, and a five-year record policy does not mean every external recipient should keep portal access for five years.
Because 19 CFR 163.4 includes exceptions—including different treatment for specified packing lists and some other records—the responsible record owner should map the exact record category and applicable authority rather than applying one number to every uploaded file.
Test six portal failure states before rollout
A happy-path open is not enough. Test an unauthorized account, a revoked or expired action, a missing file, an unsupported inline format, a duplicate download, and a recipient attempting to reach another shipment. Record whether the user receives a safe explanation without learning private workspace details.
Business email links also need change-control discipline. The FBI's 2025 IC3 data reports 4,566 BEC complaints and $568,048,472 in reported losses; those figures do not measure document portals, but they reinforce the need to verify recipient and access context instead of treating possession of an email as unlimited trust.
- Deny unrelated shipment access by default.
- Keep view and download actions explicit and separately observable.
- Avoid putting confidential document contents in logs or email bodies.
- Provide a human route for expired, disputed, or incorrect access.
How the Tyllus document portal fits the workflow
Tyllus provides authenticated workspace document access and scoped partner-action experiences. Its guided demo includes a dedicated authenticated demo document portal where the demo creator can inspect isolated documents inline or download them, while the files remain outside live shipment records and partner access.
Tyllus does not decide the legal retention period, certify a record, make the recipient's device secure, prevent every authorized download from being copied, or guarantee regulatory compliance. Organizations remain responsible for access policy, device controls, record classification, retention, and professional review.
Test view and download in shipment context.
Use the guided demo to inspect isolated document access without exposing a real partner or changing live shipment records.