Designing secure monetization for a zero-trust file platform.

Traditional file sharing means losing control the instant someone downloads a copy — ownership, rights, and access are gone. For creators, real value isn't tied only to the file, but to its journey: who has it, how it's used, and whether it stays protected.

Superfile changes the model — upload, grant access, monitor usage, modify permissions, revoke access, maintain ownership. It flips ownership from a lost event into an adaptive, monitored, revocable system where the file stays an asset, not a liability. The challenge I owned was letting people sell access to those files without ever weakening security or trust.

To shift digital ownership, we designed around permission states and resilient access control. Instead of files being infinitely replicable, the system tracks provenance, authenticates viewers, and adapts permissions dynamically.

Ownership context loops from the creator through the file; permissions are then layered and states enforced for every viewer — much like enterprise SaaS documentation, but for creative rights.

The Superfile ecosystem spans a macOS app, web platform, secure viewers, payments, permissioning, ownership verification, accounts, and tracking. Together these systems enforce digital rights and enable creative monetization.

The system map lays out roles, relationships, and routes of value across the platform — making the complexity navigable for every audience, from engineers to investors.

Payment wasn't meant to replace security — it was meant to sit on top of it.

The push for monetization came directly from leadership and investors, with a focus on the ownership of files. The audience wasn't just creators — it was owners of digital assets who want control, protection, and the ability to sell access without giving up ownership.

That framing immediately ruled out traditional paywall patterns. If access could be copied, bypassed, or granted prematurely, the product would undermine the very idea of ownership it claimed to protect.

I owned this work end-to-end across product strategy, UX, and engineering execution.

Stripe was used intentionally as the transaction layer rather than reinventing payments in house. The work wasn't simply integrating a checkout form — it was defining how an external payment provider could safely trigger access inside a security-first system. I led the design and implementation strategy for how Stripe events connected to Superfile's access model.

Payments were treated as a prerequisite for access, not proof of ownership. A successful transaction didn't unlock a file by default — it only allowed the system to release access after payment confirmation was validated and matched against the correct file and recipient. This let Superfile support retries, failures, and revocation without exposing sensitive states or granting premature access.

The system map became a shared contract between design and engineering, defining ownership boundaries and distinguishing which states were technically impossible versus simply undesired.

Monetization had to exist inside the product without weakening its zero-trust foundation.

Rather than relying on Stripe's default checkout, I designed a custom pay-card component that lived natively inside the Superfile experience. This let us control how payment intent was expressed and validated, while ensuring transactions could never directly grant ownership or bypass the security model.

The pay-to-unlock surface is a layered component structure that separates payment intent from access authority, so monetization never weakens Superfile's security model. Each layer increases system authority while intentionally reducing user-controlled outcomes — from primitive inputs like card number and cardholder name, up through the transaction-intent layer, to the container that finally grants access.

A major decision was whether to implement platform-specific payment logic for macOS versus web. Native implementations felt appealing but introduced long-term risk of divergence in payment behavior, webhook handling, and security assumptions. I proposed embedding a lightweight web view inside the macOS app so both platforms reused the same Stripe checkout flow and backend logic — reducing the surface area for bugs and security drift.

Complex technology only matters if people understand it. Before, investors saw technical diagrams and processes; after, they grasped the narrative — problem, ownership, monetization, control, market opportunity. Visual storytelling became a core tool for bridging technical depth and business value.

Discovery, product definition, architecture, design systems, investor demos, user testing, engineering collaboration, and fundraising support — every phase required systems thinking, from inside the interface to the pitch deck.

Throughout the project I ran structured sprints alongside the product manager, prioritized work in Jira, and documented system flows, UI decisions, and constraints in Figma and Notion. These artifacts weren't just deliverables — they were safeguards against misalignment in a security-sensitive feature, crucial while Superfile pivoted and changed features often.

The product launched internally and was tested and used by investors, who successfully experienced the pay-to-unlock feature while logged into their invite-only Superfile accounts.

Superfile's journey was less about pixels and more about frameworks, relationships, and outcomes — a lesson in product narrative as much as product design.