Power Viewer
System Architecture
Three elements, and where each one lives
Running Power Viewer across an organisation involves three things: the group policy file, the album database and eCTD storage. This page explains how they fit together and, above all, where each of them can be placed. Written for IT staff planning a deployment and for Power Viewer administrators.
Group Policy File
The settings file an administrator creates and distributes. It carries the licence key and which album database to connect to.
Album Database
The database that consolidates application and document metadata — the hub of eCTD management. Choose one of three deployments.
eCTD Storage
Where the actual eCTD files sit. A collective name for local and network folders, SharePoint, Box and the rest.
What the album database holds is only the registration record for eCTD storage — where it is and how to connect to it. eCTD storage itself sits outside the album database, and eCTD files are never imported into it.
How the three fit together
Each element remembers or references the location of the next one, in a single chain. The point most often misunderstood is the boundary between the album database and eCTD storage: the album database holds nothing but a registration record. eCTD storage itself, and the actual files inside it, always sit outside it.
"eCTD storage" and "eCTD storage registration" are different things
eCTD storage is the place the actual eCTD files sit — a collective name for local and network folders, SharePoint, Box, Google Drive and Veeva Vault. The eCTD storage registration is the record in the album database saying which of those to use and how to connect to it. Only the latter lives in the album database; eCTD files are never imported into it.
Where each one can be placed
The three elements differ in where they can live.
○ supported ／ △ conditional / not recommended ／ × not supported
Group Policy File
group-policy.pvaf (an encrypted settings file)
- ○ supported
- Internal file server / shared folder recommended Both UNC paths and mapped drives work. One file serves every workstation, and because normal use only ever opens it for reading, a read-only share is sufficient.
- ○ supported
- Local folder on each PC You then distribute and update the file per machine, and every settings change has to be rolled out again.
- ○ supported
- Cloud storage sync folder Point at the folder that OneDrive, Box and similar clients sync locally. The application simply treats it as an ordinary local path. Because Group Policy is updated infrequently, the risk of file corruption due to synchronization conflicts is low.
- × not supported
- An HTTP(S) URL Only file paths are supported. The file cannot be served from a web server and referenced by URL.
- × not supported
- A location set through the registry or an environment variable Neither is supported. This file is unrelated to Windows Group Policy (GPO); there is no mechanism for distributing the path through a GPO.
Album Database
Choose one of three deployments
- ○ supported
- File edition (SQLite) — shared folder or NAS No additional contract required. A single database file in a shared folder serves everyone. Backups and contention are yours to manage.
- ○ supported
- Cloud edition (Hosting) — our servers Requires a Hosting contract. Sites share one database without you providing a file server or VPN; you only enter a tenant ID.
- ○ supported
- On-premises edition (Onprem) — your own server, in Docker Requires an Onprem contract. Functionally identical to the cloud edition, but no data leaves your organisation. See the requirements below.
- △ conditional / not recommended
- The file edition in a cloud sync folder If several people open it at once, sync conflicts can corrupt the file, so we do not recommend this for shared use. Use the cloud or on-premises edition to share across sites.
- × not supported
- Alongside an existing database server Installing into your existing SQL Server, PostgreSQL or similar is not supported.
eCTD Storage
Where the actual eCTD files sit
- ○ supported
- Local or network folder default UNC paths and mapped drives are both supported. An administrator can pin the root folder that paths resolve against so every workstation agrees.
- ○ supported
- SharePoint Online An API connection to your own Microsoft 365 tenant. Works with either the OAuth application we provide or one you register yourself.
- ○ supported
- Box and Google Drive Both support the OAuth client we provide (Hosted) as well as an application you register yourself.
- ○ supported
- Veeva Vault BETA Offered as a beta. Please confirm the supported scope before relying on it.
- × not supported
- OneDrive on its own Not selectable in the current release. On Microsoft 365, use SharePoint Online instead.
- × not supported
- Uploading to our servers No such capability exists. eCTD files are never transmitted to or stored on our servers.
eCTD storage is accessed read-only
Power Viewer never modifies or deletes eCTD files. Box is the one exception in which its permission model obliges you to grant a write scope — no writes are actually performed. All HTTP traffic from the application, including traffic to these cloud services, follows the proxy settings recorded in the group policy file.
For how to register each cloud service, see eCTD Storages .
On-premises edition (Onprem) requirements
| Item | Requirement / guideline |
|---|---|
| OS and runtime | Linux with Docker. Docker Desktop on Windows is not supported |
| Server specification | Minimum 2 vCPU / 4 GB RAM / 40 GB disk, scaled up with your data volume |
| Networking | HTTPS is required and the certificate is yours to provide. HTTP is only accepted from the same host |
| Form of the URL | Host name only. A URL with a path (for example https://example.com/pv/) cannot be used |
| Licensing | Separately from the Business licence key, one server licence key per server is required |
| Scale guideline | Sized for roughly 10 concurrent users and around 500 GB per database |
| Redundancy and backup | A single-server deployment is assumed. Redundancy and disaster recovery are your responsibility |
These figures are design assumptions. Please confirm against the deployment materials for your specific installation.
For the full procedure, see: On-Premises Edition Server Preparation Guide / On-Premises Edition Setup Guide
Three representative deployments
The three diagrams below use the same building blocks in the same positions. The only difference is where the album database sits.
The arrows mean the same thing in each
- ① read the group policy file to learn where to connect
- ② connect to the album database
- ③ read the actual files from eCTD storage
Step ③ never passes through the album database in any of the three. eCTD files never travel through our servers.
A. File edition — everything in a shared folder
- Suits
- A single site with a small team, with no appetite for running a server
- Contract
- Business only, with nothing additional
- Operational burden
- Backing up the shared folder and managing contention are yours
B. Cloud edition — shared through our servers
- Suits
- Sharing across sites without building a server
- Contract
- Business plus Hosting
- Operational burden
- We run and back up the database. Only the database contents leave your network
C. On-premises edition — shared, entirely in-house
- Suits
- Sharing across sites when data may not be held outside the organisation
- Contract
- Business plus Onprem, including a server licence key
- Operational burden
- Building, updating and backing up the server are yours
Where each kind of data lives
The question security reviews ask most often, answered per deployment.
| Data | A. File edition | B. Cloud edition | C. On-premises edition |
|---|---|---|---|
| The eCTD files themselves (PDF and so on) | Your storage | Your storage | Your storage |
| Application and document metadata, backbone XML | Your shared folder | Our servers | Your server |
| Users, access rights, activity log | Your shared folder | Our servers | Your server |
| eCTD storage registration (endpoint, credentials) | Your shared folder | Our servers | Your server |
In all three deployments the group policy file sits in your own shared folder or on your workstations. It is never transmitted to us.
How encryption works
| Subject | Protection | Key custody |
|---|---|---|
| Group policy file | The whole file is encrypted | Built into the application; nothing for an administrator to set |
| Album database (file edition) | The whole file is encrypted with a password | Set by the administrator. Lose it and the database cannot be opened |
| Secret fields of the eCTD storage registration (cloud and on-premises editions) | Encrypted at rest on the server | Ours for the cloud edition. Yours for the on-premises edition — lose the key and stored registrations cannot be recovered |
Who can see what, and what gets recorded
How access control and audit logging work when the album database is shared across an organisation.
This section describes organizational use under a license key (the Business plan). Free use does not involve an album database at all, so there are no user accounts and no access permissions.
Roles
| Role | What it can do |
|---|---|
| Administrator | Everything: change user roles, organize groups, grant access permissions, and read the audit log. Never restricted by access permissions. |
| GroupPolicyEditor | Viewing, plus the ability to edit the group policy file. |
| Viewer | Viewing only. No editing rights. |
| Guest | The provisional state on first sign-in. No permissions are granted until an Administrator assigns a proper role. |
Only an Administrator can change roles — and not their own.
How permissions are granted
Permissions are held by user groups as "keys", not attached to individuals.
Joining a group grants the key; leaving revokes it
A user gains a group's keys by joining it and loses them by leaving. One person can belong to several groups, so there is no need to rebuild accounts when people move between teams.
Per application (Application Access Key)
Makes the applications in the target album viewable. You can narrow the scope with a minimum Priority; when a user holds several keys, the widest value applies.
Per document (Document Access Key)
Controlled by eight kinds of condition: path substring, a specific file by SHA256 / MD5, file extension, restriction to parts of m5 (STDM / ADaM), and download permission. Keys are Allow or Deny, and Deny wins where both apply.
Built-in groups for open access
All User (every signed-in user, Guest included) and All Registered User (every registered user) exist by default. Giving them a key publishes an album without enrolling anyone individually. These two groups cannot be edited or deleted.
Audit log
Operations against the album database are recorded automatically (app v3.0.0 and later).
- Five kinds of entry are recorded: sign-in, create, update, delete, and log compression
- Coverage is the creation / update / deletion of albums, applications, submission units, documents, application tags, access keys, eCTD storages, user accounts and user groups — permission changes included
- Updates record the before and after values
- Timestamps are recorded in UTC
- Only an Administrator can read the log
- Logs can be archived and removed, but the fact that an archive was performed remains in the log
What is not recorded
The log covers sign-ins and changes to data and permissions. It does not record who opened which document — read access itself is not tracked. If tracking read access is part of your requirements, please talk to us first.
Sign-in methods
| Method | Details |
|---|---|
| Microsoft Entra ID | Authenticate with an Entra ID (Azure AD) account. |
| Active Directory | Authenticate with an account in your Active Directory. |
| ID and password | Authenticate with credentials registered in the album database. |
The method is recorded in the license key and fixed per album database. Users cannot switch it themselves.
Controlling data egress and features
The group policy file sets what is permitted across the whole organization. The controls that bear on taking data out are:
- Whether eCTD HTML export is allowed (everyone / Administrator only)
- Whether grids can be saved as CSV (everyone / Administrator only)
- Whether PDFs may be opened in the default application
- Whether text in PDFs may be selected and copied
- Whether cloud credentials (refresh tokens) may be stored on the device
- Whether error reports may be sent
- Sign-in mode (online / offline)
Settings are written into the group policy file and applied automatically to everyone it is distributed to. Restricted operations appear disabled, with the reason shown on screen.
For the step-by-step design of roles, groups and access keys, and for using the audit log screen, see the user guide .
Pre-deployment checklist
What to confirm when you settle on a configuration.
- 1 Decide where the group policy file goes A shared folder reachable from every workstation is recommended, and a read-only share is fine.
- 2 Check the permissions on that folder The file contains a licence key and connection details, so limit visibility to the people who need it.
- 3 Choose the album database deployment Pick A, B or C on three questions: how many sites, whether data may leave the organisation, and whether you can run a server.
- 4 For the file edition: choose the encryption password and store it safely Lose it and the database cannot be opened; there is no recovery route.
- 5 For the file edition: arrange backups of the shared folder Backups and contention management are yours.
- 6 For the on-premises edition: prepare a Linux host with Docker and a TLS certificate A separate server licence key is also required.
- 7 For the on-premises edition: back up the encryption key Without it, stored registrations cannot be recovered.
- 8 Behind a proxy, record the proxy settings in the group policy file All HTTP traffic from the application follows them.
- 9 Decide on your eCTD storage, grant the necessary permissions, and register it in the album database Cloud services also need OAuth consent on your own tenant.
- 10 Write network paths consistently UNC paths on some machines and mapped drives on others is a common cause of references not lining up.
- 11 Prove the whole chain on one machine first Confirm that the group policy file loads, the album database connects and an eCTD displays before rolling out widely.
Need help?
Check the FAQ or feel free to reach out with any questions.