Hanzo Dataroom

API reference · Dataroom → — every endpoint, generated from the OpenAPI spec.

Hanzo Dataroom is an open-source secure document-sharing platform — a self-hostable fork of Papermark (AGPLv3) — with real-time analytics, granular access controls, and custom branding. Share pitch decks, fundraising materials, and legal documents through controlled links, and organize due-diligence material into structured data rooms with full visibility into how recipients engage. It runs as a standalone Next.js application at dataroom.hanzo.ai and signs in through Hanzo IAM.

Features

Shareable Links: Per-link expiration, password protection, email verification, and allow/deny lists
Watermarking: Dynamic watermarks stamped with viewer information
Screenshot Protection: Discourage capture of sensitive material
Custom Domains & Branding: Per-team logos and colors, custom domains, and custom link metatags
Data Rooms: Multi-document collections with folders, viewer groups, and granular permissions
Real-Time Analytics: Page-by-page view tracking, time spent, downloads, and per-page reactions
Conversations: Comment threads on documents and data rooms
AI Q&A: Chat over documents and data rooms (optional; requires a model-provider key)
File Requests: Collect document uploads from visitors through a link
Link Presets & Tags: Reusable link configurations and labels across links, documents, and data rooms
NDA & Agreements: Require acceptance before viewing
Enterprise SSO: SAML via BoxyHQ Jackson, plus SCIM directory sync
Passkeys: WebAuthn authentication via Hanko
Hanzo IAM SSO: Single sign-on via Hanzo identity

Endpoints

Environment	URL
Production	`https://dataroom.hanzo.ai`
API	`https://dataroom.hanzo.ai/api`

Architecture

+---------------------------------------------------------------+
|                     HANZO DATAROOM                             |
+---------------------------------------------------------------+
|                                                                |
|  +-----------------------+  +-------------------------------+  |
|  |    Documents          |  |       Data Rooms              |  |
|  |  +------+  +-------+  |  |  +--------+  +-------------+  |  |
|  |  | Links|  |Version|  |  |  |Folders |  | Permissions |  |  |
|  |  +------+  +-------+  |  |  +--------+  +-------------+  |  |
|  +-----------------------+  +-------------------------------+  |
|                                                                |
|  +-----------------------+  +-------------------------------+  |
|  |    Analytics          |  |       Access Control          |  |
|  |  +------+  +-------+  |  |  +--------+  +-------------+  |  |
|  |  | Views|  | Time  |  |  |  |Password|  | NDA/Email   |  |  |
|  |  +------+  +-------+  |  |  +--------+  +-------------+  |  |
|  +-----------------------+  +-------------------------------+  |
|                                                                |
+---------------------------------------------------------------+

How It Works

The full workflow runs in the dashboard.

Upload a Document

Upload a PDF (or other supported file) to your team's library. Uploads go to S3-compatible object storage or Vercel Blob, depending on the configured transport, with resumable upload support.

Generate a link and attach controls — a name, optional password, expiration date, email verification, allow/deny lists, download permission, and watermarking. Share the resulting /view/... URL with recipients.

Track Engagement

Watch views arrive in real time: who opened the link, how long they spent on each page, which pages they revisited, and what they downloaded.

Data Rooms

Organize documents into structured data rooms for due diligence, fundraising, or any multi-document workflow. Each data room supports nested folders, viewer groups, and permission groups so different recipients see different subsets, with an optional introduction page and per-room change notifications.

Access Controls

Feature	Description
Password Protection	Require a password to view
Email Verification	Require a verified email
NDA Agreement	Accept an NDA before viewing
Expiration Date	Auto-expire links
Download Restriction	Prevent file downloads
Watermarking	Dynamic watermarks with viewer info
Screenshot Protection	Discourage screen capture
Allow / Deny Lists	Restrict to (or block) specific emails or domains

Analytics

View Metrics

Metric	Description
`totalViews`	Total number of views
`uniqueViewers`	Unique email addresses
`avgDuration`	Average time spent
`completionRate`	% of pages viewed
`lastViewedAt`	Most recent view

Per-Page Analytics

Track engagement at the page level to understand which sections resonate:

Time spent per page
Page revisits
Per-page reactions
Download activity

Authentication

Hanzo Dataroom signs users in through Hanzo IAM and supports:

Hanzo IAM: SSO via https://hanzo.id (default, recommended)
Email Magic Link: Passwordless email login
Passkeys: WebAuthn/FIDO2 authentication via Hanko
SAML SSO: Enterprise SSO via BoxyHQ Jackson, with SCIM directory sync
Google OAuth: Optional legacy provider

IAM Integration

# Environment variables
IAM_URL=https://hanzo.id
IAM_CLIENT_ID=app-dataroom
IAM_CLIENT_SECRET=<from-kms>

Self-Hosting

Hanzo Dataroom ships as a Next.js standalone application with an embedded SQLite database by default (single-replica), so a basic deployment needs only a persistent volume and object storage.

Docker

docker run -d \
  --name hanzo-dataroom \
  -p 3000:3000 \
  -v dataroom-data:/app/data \
  -e NEXTAUTH_URL=https://dataroom.yourdomain.com \
  -e IAM_URL=https://hanzo.id \
  -e IAM_CLIENT_ID=app-dataroom \
  ghcr.io/hanzoai/dataroom:latest

Environment Variables

Variable	Description
`DATABASE_URL`	Database connection (embedded SQLite by default)
`NEXTAUTH_URL`	Public URL of the application
`NEXTAUTH_SECRET`	NextAuth encryption secret
`IAM_URL`	Hanzo IAM server URL
`IAM_CLIENT_ID`	IAM application client ID
`IAM_CLIENT_SECRET`	IAM application client secret
`NEXT_PUBLIC_UPLOAD_TRANSPORT`	Storage backend — `s3` or `vercel`
`S3_*`	S3-compatible object storage credentials
`SMTP_HOST`	Email server host

Integrations & API

Hanzo Dataroom is primarily a dashboard-driven product: documents are uploaded, links are created, and analytics are viewed in the app. Programmatic surfaces include:

Next.js API routes under /api (unversioned) — links, views, teams, verification, and file handling used by the app and its share pages.
SAML SSO & SCIM for enterprise identity and directory sync.
Incoming webhooks and Slack notifications for view and download events.
AI Q&A endpoints for chat over documents and data rooms.

Refer to your instance and the self-hosting configuration for the exact route set.

Next Steps

Document signing platform

Equity management platform

Identity and access management

Hanzo Dataroom

On this page