Encryption with workspace key support
Objects are encrypted at rest. When a workspace has a Cloud KMS key configured, uploads and promoted clean objects use that workspace-specific key reference.
Security from upload to retrieval
Private storage, explicit trust transitions, scoped access.
Findset encrypts stored objects, supports a workspace-specific Cloud KMS key, scans every uploaded version before access, and keeps database operations inside a forced workspace boundary.
- Encryption at rest
- Malware scanning and quarantine
- Forced workspace isolation
Security architecture
Protection is layered across storage, data, identity, and service access.
Storage, data, identity, and service access each add their own check.
Forced row-level isolation
Workspace tables use forced PostgreSQL row-level security. Each transaction sets the active workspace context before data access.
Permissioned knowledge
Workspace roles and explicit read, comment, edit, and manage page grants determine what a member can do.
Signed service authentication
Registered products use Core-issued tokens checked against the caller, operation scope and workspace, with request IDs for writes.
File trust pipeline
A file is ready once it passes the scan.
Each file version moves through separate private storage zones and becomes readable only after its declared bytes and security result are verified.
01
Receive into private unscanned storage
The client gets a short-lived V4 upload URL tied to content type, checksum, expiration, and the workspace KMS key when configured.02
Verify and inspect
Findset confirms size and SHA-256, detects file type, scans for malware, and sanitizes SVG content before promotion.03
Promote clean or isolate unsafe
Clean bytes move into the private clean bucket. Infected or unsafe results move to quarantine and stay there.
After the scan
Clean files stay private.
Access remains narrow after a file passes inspection, and every version keeps its own evidence.
Short-lived signed downloads
Ready files open through signed read URLs that expire.
Revocable public renditions
A registered product can expose one clean version through a random token whose hash is stored and whose access can be revoked.
Version-level evidence
Each version records its SHA-256 checksum, declared and detected MIME type, scan result, scan detail, timestamps, and encryption-key reference.
Audited lifecycle
Upload, scan completion, document changes, trash, restore, and purge decisions generate explicit state or audit evidence.
Recovery and deletion
Deletion is deliberate, recoverable, and usage-aware.
Trashed files remain recoverable for 30 days. Permanent purge removes unscanned, clean, and quarantined objects, and active product usage blocks deletion until the reference is released.
Security you can reason about
Useful knowledge, clear access.
Use encrypted storage, explicit collaboration permissions, scan evidence, and private access as one connected workflow.