The upload remains private in quarantine while signature, checksum and malware checks run.
Decision: Hold privateEvidence: Scan state retained
01 / IntakePrivate until cleanQuarantine precedes availability.02 / AccessDeny by defaultEvery resource request is authorized.03 / AssuranceMFA + step-upSensitive actions ask for more proof.04 / EvidenceTamper-evidentAudit rows form an append-only chain.
Before access / 01
The file waits outside.
A filename or extension is not trusted as proof. FileMentra checks the bytes, records the verdict and only promotes a clean result into available storage.
01
QuarantineUploaded bytes stay private.
02
IdentifyMagic bytes determine the actual type.
03
VerifyChecksum and scan results are evaluated.
04
PromoteOnly a clean result becomes available.
Upload inspection / FM-8431
Declared fileBoard_Pack.pdf
Detected signaturePDF document
ChecksumMatch
AvailabilityBlocked while processing
Clean result recordedPromoted without bypassing quarantine.
At the boundary / 02
Access is a fresh decision.
A link is a narrow request, not a master key. Scope, recipient, expiry and current policy are checked again when access is redeemed.
Boundary evaluation
Named transfer recipient
Access narrowed
ResourceNamed transfer versionNo workspace listing.ActionDownload within policyNothing beyond explicit scope.LifecycleExpiry + immediate revocationChecked on every redemption.Storage URLShort-lived resultNever the authorization credential.
Allowed only while recipient, link and file policy all agree.
For security operators / 03
A calm place to see what needs attention.
Security Center brings workspace posture, members, sessions, policy, alerts, access reviews and audit evidence into one readable administrative surface.