> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Storage Overview

> Architecture and operator entry point for CaseBender object storage

CaseBender stores attachments, evidence, exports, quarantine objects, and
ephemeral canaries in file/object storage. New installs default to a local
Docker volume. You can keep that volume with any license, or point CaseBender
at customer-owned S3, GCS, or Azure. See
[Local Storage Limitations](/en/deployment/storage-local).
PostgreSQL keeps durable object identity, exact provider version, integrity,
scanner, retention, hold, migration, and lifecycle state.

## Architecture

Every deployment defines three profiles:

* `quarantine` receives user-controlled uploads;
* `records` holds scanner-approved durable data and generated exports; and
* `ephemeral` holds canaries and short-lived objects.

The shared `@cbr/storage` boundary implements canonical adapters `s3`, `gcs`,
`azure`, and `local`. Runtime operations include health, upload, download,
exists, list, metadata, copy, delete, retention, and legal hold. Runtime never
creates or configures buckets/containers and never generates signed URLs.

User uploads are written behind a durable upload intent, read back and
SHA-256-verified, scanned by external `clamd`, and copied to `records` only
after a clean verdict. Durable mutation, migration, and reconciliation workers
retry idempotently and expose dead-letter/integrity telemetry.

## Start here

<CardGroup cols={2}>
  <Card title="Support Policy" icon="scale-balanced" href="/en/deployment/storage-support-policy">
    Current machine-readable support and qualification status
  </Card>

  <Card title="Select a Provider" icon="list-check" href="/en/deployment/storage-provider-selection">
    Compare live certification requirements and evidence levels
  </Card>

  <Card title="Security Baseline" icon="shield-check" href="/en/deployment/storage-security-baseline">
    Quarantine, scanning, integrity, encryption, WORM, and secret controls
  </Card>

  <Card title="Backup and Restore" icon="database" href="/en/deployment/storage-backup-restore">
    Protect PostgreSQL and exact object versions as one set
  </Card>

  <Card title="Migration Runbook" icon="right-left" href="/en/deployment/storage-migration-runbook">
    Copy-first cutover, ledger verification, source retention, and rollback
  </Card>

  <Card title="Health and Troubleshooting" icon="stethoscope" href="/en/deployment/storage-health-troubleshooting">
    Readiness categories, canary, scanner, CA, permissions, and dead letters
  </Card>
</CardGroup>

## Provider guidance

<CardGroup cols={2}>
  <Card title="OpenShift ODF/Ceph RGW" icon="redhat" href="/en/deployment/storage-openshift-odf-rgw">
    External OBC or standalone RGW with private CA and restricted egress
  </Card>

  <Card title="AWS S3" icon="aws" href="/en/deployment/aws">
    Existing buckets and workload identity
  </Card>

  <Card title="Google Cloud Storage" icon="google" href="/en/deployment/google-cloud-run">
    Existing buckets and Workload Identity
  </Card>

  <Card title="Azure Blob" icon="microsoft" href="/en/deployment/azure">
    Existing containers and Managed Identity
  </Card>

  <Card title="S3-Compatible Products" icon="certificate" href="/en/deployment/storage-s3-compatible">
    Exact-product/version live certification policy
  </Card>

  <Card title="Local and MinIO" icon="triangle-exclamation" href="/en/deployment/storage-minio-lifecycle">
    Development-only local storage and legacy MinIO migration
  </Card>
</CardGroup>

<Warning>
  Adapter or emulator success does not equal live product certification. Current
  ODF/Ceph RGW is qualification-ready but awaits customer credential-gated
  exact-version evidence.
</Warning>