Skip to main content
Revision: 2026-10-13.

​
Private workspace vault

Vault documents belong to one workspace and environment. An active workspace member can inspect and download accessible documents. Workspace owners and administrators manage uploads, versions and retention controls. A public documentation link never grants access to a workspace file. The initial vault API requires a signed-in workspace session; API-key access is not enabled. Each upload stores the file, SHA-256 checksum, authenticated uploader and version metadata together with its activity record. Downloads check stored size and checksum before returning an attachment. Uploaded files are not rendered as executable pages. Format and checksum validation are not malware scanning or a review of document accuracy. Supported files are PDF and UTF-8 text, Markdown, JSON or YAML. The limits are 5 MiB per file, 100 versions per document and 100 MiB of retained file contents per workspace environment. Private contents use the managed database’s storage and backup controls; the vault is not a client-held-key or zero-knowledge storage service.

​
Versions and access history

A new upload creates a separate version. Prior version bytes and checksums are not edited in place. The document view shows version history and the latest 100 activity entries, including uploads, downloads and lifecycle decisions. History records the authenticated actor. This history is not a claim that an external auditor has reviewed the document.

​
Retention and disposal

Archive a document to stop new version uploads. A hold blocks purging. A minimum retention date can be extended but cannot be shortened or removed once set. Changes require an explicit reason and confirmation. An owner or administrator can purge file contents only after archive, with no active hold or future retention date. Purging removes the current stored bytes from all versions and preserves metadata, checksums and audit history. Backup copies expire under the backup retention policy. Files already downloaded by recipients cannot be recalled. Choose retention according to your organization’s approved requirements. The product does not infer a legally required period from a document category. Cross-service erasure, legal review and organization-wide retention evidence require separate assessment.