Protecting work files in corporate chat
A file carries more risk than a short text: it remains on disk, passes through parsers, and may contain a malicious payload.
Validate before storage
The backend restricts size, extension, and declared MIME, then determines actual type. A user-supplied filename never becomes a storage path.
An upload is bound to workspace, conversation, and membership. A private attachment is never exposed through a guessable public URL.
Separate scanning from the claim
If no antivirus provider exists, the interface does not say “scanned.” Under strict E2EE, a server scanner cannot see plaintext, so inspection moves to endpoints or a distinct enterprise mode.
Previews and thumbnails are derivative files and belong in retention and purge inventory.
Delete every derivative object
Purge removes the primary object, multipart remnants, previews, cache, and metadata. Provider receipts must not include filenames or sensitive content.
An official client clears downloaded copies after a wipe command, but manually exported files remain outside service control.
This guide explains verifiable product principles and is not legal advice.