> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Storage Provider Selection and Certification

> Select a provider without confusing adapter compatibility with live certification

Select storage by operational requirements first, then confirm the release's
machine-readable support declaration. CaseBender does not treat every backend
implemented by an SDK as release-certified.

## Selection flow

1. Choose an external, customer-managed service reachable by both web and
   worker.
2. Provision separate `quarantine`, `records`, and `ephemeral` locations.
3. Confirm identity, TLS/private CA, encryption, versioning, retention, legal
   hold, audit logging, egress, backup, and restore requirements.
4. Compare the exact product profile with
   `scripts/storage/certification-matrix.json`.
5. Run live qualification against the exact product/version from the workload
   network.
6. Sign and retain sanitized evidence with the release record.

## Current matrix interpretation

| Matrix ID              | Runtime adapter | Declared supported | Required mode | Operator meaning                                               |
| ---------------------- | --------------- | ------------------ | ------------- | -------------------------------------------------------------- |
| `openshift-odf-rgw`    | `s3`            | Yes                | `live`        | Support target only after exact ODF/Ceph live evidence passes  |
| `aws-s3`               | `s3`            | No                 | `live`        | Implemented adapter; do not claim release certification        |
| `google-cloud-storage` | `gcs`           | No                 | `live`        | Implemented adapter; do not claim release certification        |
| `azure-blob`           | `azure`         | No                 | `live`        | Implemented adapter; do not describe Azure as unsupported code |
| `local-development`    | `local`         | No                 | `unit`        | Development/single-node testing only                           |

Current ODF/Ceph live evidence is blocked on customer credentials. It is
configured and qualification-ready, not certified. Update customer-facing
status only after the release validator accepts signed exact-version evidence.

## Evidence levels

* **Unit** proves local adapter behavior in controlled code tests.
* **Emulator** proves SDK and contract compatibility with an emulator's subset.
* **Live** proves the required operations against a named product and exact
  version in the intended network, trust, identity, and policy context.

Emulator results can never satisfy a matrix entry whose
`requiredCertification` is `live`. Product family names such as “S3
compatible,” “Ceph,” or “Azure Blob” are insufficient without an exact target
version and evidence digest.

Emulator compatibility is not live certification.

## Validate the matrix

```bash theme={null}
node scripts/storage/validate-certification-matrix.mjs
node --test scripts/storage/certification-matrix.test.mjs

# Release use requires a sanitized evidence JSON document.
node scripts/storage/validate-certification-matrix.mjs \
  --release \
  --evidence '<path-to-sanitized-evidence.json>'
```

Start from `scripts/storage/certification-evidence.template.json`. Never add
credentials, tokens, connection strings, private keys, object contents,
customer object names, or signed URLs to evidence.

## Configuration examples

For production, prefer a mode-`0400` or `0600` mounted
`STORAGE_CONFIG_FILE`. This shape is illustrative:

```json theme={null}
{
  "profiles": {
    "quarantine": { "provider": "s3", "bucket": "<quarantine-bucket>", "region": "<region>" },
    "records": { "provider": "s3", "bucket": "<records-bucket>", "region": "<region>", "requireWorm": true },
    "ephemeral": { "provider": "s3", "bucket": "<ephemeral-bucket>", "region": "<region>" }
  }
}
```

The complete strict profile schema is documented in the provider pages. Do not
put access keys in documentation or commit a populated configuration file.

## Requalification triggers

Re-run live evidence after changing any of:

* CaseBender release or storage SDK;
* provider, ODF, Ceph, account, or API version;
* bucket/container security, versioning, retention, or immutability;
* identity, role, credential, endpoint, private CA, or egress policy;
* scanner/promotion boundary; or
* backup, migration, and restore tooling.

Related guidance:

* [Enterprise Storage Support Policy](/en/deployment/storage-support-policy)
* [S3-Compatible Certification](/en/deployment/storage-s3-compatible)
* [Storage Release Security](/en/deployment/storage-release-security)