Signing in
People sign in through your own identity provider over OpenID Connect. Employees, automated systems and outside recipients stay three separate kinds of user: one never quietly becomes another.
Security architecture
How the file is protected: identity, keys, separation and the trail it leaves.
Every file version is encrypted with its own key. Your organisation’s data is kept apart from every other customer’s. People sign in through your identity provider, and the decisions that follow are recorded. The same applies whether it is an employee, an outside recipient or one of your own scripts.
Encryption keys
Each version of a file gets its own key, and that key is wrapped by a key belonging to your organisation. Managed cloud key services are in use on the live cell; holding that wrapping key yourself remains a separate, higher-assurance path.
Separation between customers
Every request carries your organisation with it, right down to the database. There is no query path that lets one customer’s files appear in another customer’s results.
Durability lanes
Main, replica and disaster are three different jobs.
A sealed write lands on the main store first. Casewelt can copy it to an online replica for failover, and optionally to a disaster archive that is not used for ordinary reads.
If your organisation attaches its own buckets, you choose whether to add your own replica and disaster endpoints, or to opt into Casewelt’s disaster vault. Declining all of those is allowed, and then durability is explicitly your organisation’s responsibility.
MainPrimary write: user traffic waits only here
ReplicaOnline copy: used if main does not answer
DisasterArchive, not failover, not everyday download
Sessions, devices and events
When you end a session, it ends there and then.
You do not have to wait for a token to expire, and you do not have to reset anyone’s password to get someone out. Sign-ins are short-lived anyway, and revocation takes effect in the product immediately. Automated systems use their own enrolled credentials and certificates rather than borrowing a person’s login.
The audit record is added to, never rewritten. Outbound events are signed so you can prove they came from us, protected against replay, and retried when your endpoint is down. If one was missed, an administrator can look at the delivery history and send it again.
Explore the security modelInspect architecture
Walk through the controls with your security team.
Bring the identity provider, key-management preference and audit destinations you already run. We’ll centre the demo on those integrations.