> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Storage Security Baseline

> Mandatory controls for uploads, object integrity, access, retention, and telemetry

Apply this baseline to every production storage profile and validate it in the
customer environment.

## External storage and identity

* Use only pre-created customer-owned external buckets or containers.
* Deny public access and account-wide administration.
* Use workload identity/default credential chains with the narrowest
  bucket/container and prefix permissions required by web and worker.
* Keep administration, preflight attestation, runtime object operations,
  migration, and retention responsibilities separate where the platform
  permits.
* Store secrets in the platform secret manager. Never put them in source,
  ConfigMaps, images, shell arguments/history, logs, telemetry, support bundles,
  or certification evidence.
* Keep TLS verification enabled. Mount private CA files read-only and rotate
  them with an overlap procedure.

Runtime adapters perform data-plane operations only. They must not create,
delete, or configure storage locations.

## Three purpose profiles

* `quarantine`: all user-controlled uploads enter here.
* `records`: only scanner-approved user uploads and narrowly defined trusted
  server-generated exports become available here.
* `ephemeral`: deep canaries and short-lived data with a bounded lifecycle.

Use different buckets/containers when policy separation is required. Do not
grant end users direct object-store access.

## Malware scanning fails closed

Production requires external `clamd` through `CLAMD_SOCKET_PATH` or
`CLAMD_HOST`. Remote scanner TLS uses `CLAMD_TLS=true` and
`CLAMD_CA_FILE`; a plaintext private-network exception is an explicit risk
exception, not the default.

CaseBender calculates SHA-256, writes an upload intent, reads the exact object
back, and queues verification. If the scanner is unavailable, times out,
returns malformed output, or cannot scan the configured size, the object stays
quarantined. Retries are durable; exhaustion becomes a dead letter. Only a
terminal `CLEAN` verdict permits copy to `records`.

An `INFECTED` result remains quarantined and creates a sensitive security audit
event. Never download a live malware sample for troubleshooting.

## Intentional malware samples

Authorized testing may store a sample with content trust `MALWARE_SAMPLE` and
`quarantineOnly`. It remains quarantined, is never promoted, and has scan state
`SKIPPED`. Use inert EICAR-equivalent fixtures where possible. Require written
authorization, isolated handling, approved retention/destruction, and no
support-ticket attachment. Do not weaken scanning policy to make a test pass.

## Integrity and exact versions

* Persist application SHA-256, size, provider checksum, and provider
  version/generation when available.
* Verify downloaded bytes after upload, promotion, migration, backup, and
  restore.
* Treat ETags as opaque; multipart/encrypted ETags may not be MD5.
* Use conditional create to prevent overwrite races.
* Address retention, legal hold, restore, and migration by exact object
  version—not a floating latest object.
* Alert on `storage.checksum_mismatch`, missing expected objects, and confirmed
  orphans.

## Encryption, WORM, and legal hold

Require TLS and provider-managed server-side encryption. Use customer-managed
keys when mandated and verify key rotation/recovery separately.

For regulated `records`, set `requireWorm: true` and
`STORAGE_REQUIRE_WORM=true`, then qualify provider versioning, object
retention/immutability, and legal hold. Readiness fails with category
`capability` when these controls are absent. CaseBender does not bypass
governance retention by default, and compliance retention intentionally blocks
early deletion.

WORM capability in an SDK is not proof that the bucket/container was created
with the required immutable settings.

## No signed URLs

CaseBender storage adapters do not generate presigned S3 URLs, GCS signed URLs,
or Azure SAS URLs. Downloads must pass through CaseBender authentication,
authorization, tenant checks, lifecycle checks, scanner approval, and audit
boundaries.

## Health

* `/api/health/live` is process-only and has no external dependency.
* `/api/health/ready` checks configured providers and requires a fresh deep
  write/read/copy/delete canary on `ephemeral`.
* The response exposes only sanitized categories:
  `configuration`, `authentication`, `tls`, `storage`, `capability`, or
  `canary_stale`.

Never include endpoint credentials, object keys, bucket names, customer names,
or provider exception messages in a public health response.

## Telemetry and privacy

Monitor aggregated provider, operation, result, latency, byte, scanner,
quarantine, outbox, migration, reconciliation, and readiness metrics. Apply
least-access controls and retention to observability data.

Logs and metric labels may include a canonical provider and operation. They
must not include credentials, tokens, signed URLs, connection strings, private
keys, file contents, customer object names, or sensitive object keys. Sanitize
errors before persistence and support export.

See [Storage Health and Troubleshooting](/en/deployment/storage-health-troubleshooting)
and [Backup and Restore](/en/deployment/storage-backup-restore).