1. Security checks
Files undergo an automated security check before they are stored. If the check is temporarily unavailable, the file is not saved and should be uploaded again later.
2. Access and activity log
Access is limited to the applicant, the assigned manager and an administrator within their work duties. Direct public reads are disabled; downloads use a short-lived link after server-side permission and scan-status checks. Upload, replacement, review and download events are logged.
3. Versions, quotas and deletion
A replacement does not silently overwrite the previous file: a new version is created. Per-applicant limits apply to file count, total size and upload frequency. Deletion after service completion and upon a verified request will be defined in the final retention policy; mandatory legal periods take priority.
4. Backups and incidents
Database and storage objects are backed up separately. Before public launch, the file-backup schedule, retention, encryption and restore test must be confirmed. During an incident, access is restricted, evidence is preserved, risk is assessed, and affected people and authorities are notified where required by law.