Security and reliability

Authorization is enforced by the backend.

Drives own files and membership roles. Access keys can be narrowed to a drive, assigned read/write/admin authority, expired and revoked.

Delegated credentials cannot broaden their parent authority. Revoking a parent also affects its children. Temporary mount credentials remain tied to valid parent access.

Browser navigation and locally remembered sessions do not grant file authority. The server checks each supported request.

Sessions and browser credentials.

Interactive sessions use short-lived access tokens and rotating refresh tokens. The web app coordinates concurrent refreshes, retains the chosen drive in the same tab and clears local session state on sign-out.

Native browser download grants use scoped cookies with Secure, HttpOnly and SameSite protection under HTTPS. Public sharing credentials remain in URL fragments until captured and scrubbed.

External access is a specific grant.

Public links authorize a particular retained file version and can expire or be revoked. Upload requests grant bounded writes into one destination without namespace browsing.

Recipients of an upload request can supply files, not trusted content. Malware scanning is not included in the current implementation. Restrict limits and extensions where appropriate.

Committed content has immutable identity.

Immutable content and versions make historical reads explicit. Expected-version checks reject stale mutations; restoration records a new current version.

Retention determines which history remains available. Versioning is not a substitute for a separate backup of metadata and content.

Durability and recovery have clear boundaries.

The Linux client separates disposable cache from durable pending-write journals and staging. Pending changes survive client restarts.

Backup and restore tooling covers PostgreSQL metadata and object-storage content together, including file history and access controls.

Backup frequency, retention and recovery objectives depend on your deployment.

Protect transport and storage credentials.

The deployment template uses standard HTTPS termination through Caddy. Private backend object-storage credentials do not act as user filesystem access credentials.

S3 signatures and scope checks authorize the supported public S3 interface. The frontend build contains static assets and does not embed API secrets.

Provider encryption and operational controls depend on the selected deployment. End-to-end encryption and compliance certifications are not claimed.

Reporting a security issue.

Do not send credentials, private file content or signing secrets in a support report. Describe the affected version, interface and observed behavior.