What ClearExhibit Professional does—and what it does not do.

Named-presenter access

Presenter access is tied to a signed-in email and an active subscription record. ClearExhibit stores a keyed, one-way identifier for that email in billing records rather than the raw address. Access is not expanded when payment, webhook, subscription, refund, dispute, or reconciliation state is incomplete or inconsistent.

Payment separation

Stripe provides checkout and the billing portal. ClearExhibit validates the configured plan, recurring interval, amount, mode, and quantity before opening checkout, and uses signed billing events and reconciliation to update access. Exhibit content, filenames, witness links, and session activity are not sent to Stripe.

Presenter and witness controls

• A signed-in subscriber receives a separate presenter control capability for each session.
• A witness link cannot change the presenter-selected content.
• Session reads and presenter changes are revisioned so the interface can detect stale state.
• The presenter can see whether the active witness browser has acknowledged the current revision.
• Browser acknowledgment does not prove comprehension, consent, authenticity, or admissibility.

Document and session flow

The original PDF remains in the presenter browser. The selected rendered page or uploaded image is transferred to the expiring witness session. Original filenames remain in the presenter browser, and the server enforces a neutral session display name. Sessions expire after 12 hours, and expired objects are queued for cleanup.

Possession-based witness access

The witness link is unlisted and expires, but it does not authenticate the witness's identity. Anyone who receives an unexpired link can view that session. Treat the link as sensitive, share it through an approved channel, and end the session when it is no longer needed.

Application safeguards

Implemented controls include response hardening, request-size and exhibit-size limits, same-origin mutation checks, bounded event and transfer quotas, revision checks, expiring sessions, private object access through the application, operational health checks, and content-minimized billing records.

Evidence standard

Source code, hosted configuration, observed behavior, payment-provider state, operating records, and signed agreements are separate evidence sources. A feature implemented in code is not automatically enabled, independently tested, continuously operated, or contractually guaranteed.