Auto Secure LoginShared file storage where the URL is never the key.
ASL Files is the platform's shared, multi-tenant, encrypted-at-rest file store. Every blob is AES-256-GCM encrypted with a service-only key. Files are visible only within their own organization — there's no cross-tenant read path in v1 — and a stolen disk reveals nothing. It also adds Secure Send: a password-protected, expiring, two-channel way to hand a sensitive file to someone outside the platform entirely.
The problem
A link should not be a skeleton key.
Too many "secure" file services treat a long URL as the only thing standing between a document and the world — share the link by accident and the file is public. And "encrypted at rest" often stops at the file bytes, leaving file names and backups in the clear.
ASL Files requires a token even when you hold the URL, isolates every tenant so a second org gets a 404 (not a revealing 403), and encrypts the blobs and the backup archive — so even file names are protected.
Backups that prove themselves
- Online snapshot → tar → AES-256-GCM archive
- Key escrowed in ASL Vault
- Restore tested — decrypt +
integrity_check+ count blobs - Not "tar exited 0" — an actual round-trip
Capabilities
Encryption, isolation, and a safe way out.
Encrypted at rest
Every blob stored as iv‖tag‖ciphertext under a service-only key — a stolen disk yields nothing.
Integrity on every download
Files are re-verified on the way out and fail closed on any tampering.
Strict tenant isolation
No cross-tenant read path — a request for another org's file returns 404, revealing nothing about what exists.
URL is not a capability
Holding the URL isn't enough; a hardened query-token gate still requires a valid token scoped to that one file, GET-only.
Secure Send
A 10-character no-confusable password, an expiring link (1h–720h), and an open-count cap — for handing a file to an outside recipient.
Reveal nothing early
The recipient sees nothing until the password is correct, then receives the file delivered as a .zip.
Non-blocking unlock
Async scrypt means a public unlock attempt can't stall the shared event loop for everyone else.
Role-gated lifecycle
Role-gated deletion, per-file limits, and a full audit trail across every operation.
Zero-dep ZIP writer
A dependency-free inline ZIP writer — no third-party archive library in the trust boundary.
Store it encrypted. Share it safely.
Service-key encryption, strict tenant isolation, restore-proven backups, and a password-protected expiring hand-off for the outside world.