Compliance
Documents and storage
How files are stored, and why nothing is served from a public URL.
Nothing is served publicly
There is no public bucket and no CDN path. Every read goes through an endpoint that applies the access rules and only then issues a short-lived signed URL. A passport scan on a guessable path is a breach.
Uploads go from the browser straight to object storage using a pre-signed URL, so a multi-megabyte scan never occupies an application process. Authorisation happens when that URL is issued — a pre-signed URL is itself a credential for that location, so the check cannot be deferred to a later confirmation step.
- Size and content type are read back from storage rather than trusted from the client. A file uploaded as something other than what it claimed is rejected and deleted rather than left behind.
- Every stored object is prefixed by the organisation, and that prefix is checked independently of the database row — one mistake should not be enough.
- Expiry warnings are sent for documents that have one, and are treated as mandatory notifications: nobody mutes their own visa lapsing.