Malware scanning on every upload
Files are scanned by Microsoft Defender and stay locked until the verdict is clean. Infected files are quarantined for good — a verdict never downgrades.
Files judged by content, not claims
Uploads are validated against their actual leading bytes — an executable renamed to .pdf is rejected. Scripts, HTML and SVG never get in.
Tenant isolation on every request
No public links, no shared storage keys. Every download is authenticated and authorized in real time; probing outsiders see identical 404s.
Passkeys & two-factor
Modern sign-in with passkeys, 2FA with recovery codes, and external logins — on top of two independent layers of role-based permissions.
Invitations that expire
Invite links are signed and die at 14 days; unaccepted invitations are swept away automatically. A forgotten invite never becomes a backdoor.
Keys in vaults, not code
Sensitive fields are encrypted at the application layer, secrets live in managed key vaults, and infrastructure access uses short-lived cloud identities — no long-lived keys anywhere.