Secure document storage: encryption and access control

Company documents are data worth protecting

A company archive holds contracts, invoices, personnel files and customer correspondence, and with them personal data, trade secrets and obligations. Secure document storage is therefore not about putting documents away somewhere. It is about making sure they reach only the people who need them, and that nobody can read them by going around the system.

Real threats rarely look like the movies. More often it is a database copy that ends up in the wrong hands, a replaced disk, an account with broader permissions than the job requires, or a file link that keeps working for years. The GDPR requires companies to put appropriate technical and organisational measures in place, and names encryption of personal data as an example of such a measure (Article 32 GDPR).

That is why document protection rests on two layers that complement each other:

• encryption protects data when someone reaches for it outside the system, for example through a database copy;
• access control decides who can see and do what inside the system itself.

On top of that comes a trail showing who accessed a document. Below we describe how each of these layers works in CONTMAN Archive.

Document encryption: data unreadable outside the system

Encryption turns a file's content into a string of bytes that cannot be read without the key. It works in two places: on the connection a document travels along between the browser and the server, and where the document is stored. The keys decide how effective it is: if they sit next to the data, a copy of the data also carries the means to read it.

In CONTMAN Archive:

• The connection to the archive is encrypted (HTTPS). Signing in to the application works only over a secure connection.
• You switch on file encryption for a chosen document category. From then on, every new file in that category, and everything derived from it (the PDF preview, thumbnails, extracted text, signature verification reports), is stored encrypted with AES-256-GCM.
• Nothing changes for the user: the file downloads and opens as usual, and its content can still be searched by whole words.
• New files in CONTMAN HR employee files are always encrypted, as are the first name, last name, PESEL number (the Polish personal ID number) and identity document number in employees' personal records.
• You can flag a document description field as sensitive data. Its values are then stored encrypted in the database, in the document's history too.
• A backup does not contain the installation's master key: the backup script saves it separately, and the operator keeps it away from the database copies.

What does this mean in practice? Encrypted files and data cannot be read from a database dump or replica, a backup, or a copy of a disk or file storage taken without the installation's keys. The limits matter too: files stored before encryption was switched on stay unencrypted until the installation operator converts them, and encryption does not protect against a takeover of the server the archive runs on, where the keys are. Nor does it hide anything from authorised people: anyone allowed to read a document sees its data normally. That is exactly why a second layer is needed.

Document access control: everyone sees only what they need

Good access control follows the principle of least privilege: everyone gets exactly as much access as their work requires, and by default none at all. Access is granted precisely, to a type of document and to a specific action, not "to the whole archive".

In CONTMAN Archive:

• You grant permissions in roles, separately in each document category. Each category has 12 separate permissions, including reading, editing and deleting documents, downloading and previewing files, and sharing documents by link. So you can let someone read a contract's description without the right to preview or download its file.
• Creating a new category grants nobody any permissions. You decide in the roles who has access to it.
• Search respects permissions. A person without rights to a category will not see its documents in search results either: they get no refusal, the documents simply are not there.
• Sign-in is based on OpenID Connect, meaning the same account your company uses for its other systems. The archive stores no passwords, and roles are assigned to people by your organisation's sign-in service.
• Changing roles, categories or retention rules requires administrative mode, which you switch on by signing in again in the identity confirmation window.
• You can pass a document to someone without permissions via a link, but the expiry date is mandatory, and you can revoke the link at any time, immediately and irreversibly.

Accountability: you know who did what, and when

Access control is complete only when it leaves a trail. That trail lets you check who reached for a document and show it during an inspection or audit.

In CONTMAN Archive:

• A document's History tab records, among other things, when it was opened or shown on a list, changes to its description, file uploads and downloads, and shares, and each event shows who acted.
• Downloading a file and loading its preview are recorded in the history together with the version number, so you know who viewed which content, and when.
• Every opening or download of a document via a link is a separate entry in its history.
• The permission log shows who changed what in roles and permissions, and when. The system writes the entries and they cannot be changed or deleted; each entry is created in the same operation as the change, so ordinary work in the application cannot change permissions without a trace.

Integrity: versions nothing overwrites

Security also means certainty that a document is what it was. CONTMAN never overwrites anything in a stored file: every upload, replacement and restore of a file creates a new, unchangeable version, and version numbers never change.

Checklist: what to ask your document archive vendor

When choosing a system to store documents, ask the vendor a few questions:

• Is the connection to the archive always encrypted?
• Are files and sensitive data also encrypted where they are stored, and with which algorithm?
• Where are the keys kept, and can a database copy be read without them?
• Are permissions granted separately per document type and per action, with a new document type closed to everyone by default?
• Does search show only the documents a person has rights to?
• Is every opening, preview and download of a document recorded in its history?
• Do permission changes go to a log that cannot be altered?
• Do links to shared documents expire, and can they be revoked?
• Do files have versions that nothing overwrites?

Encryption and access control work together

Neither layer is enough on its own. Encryption without access control protects copies but does not decide who sees a document inside the system. Access control without encryption guards the system but cannot defend a database copy that has left it. Only together, with a history of every read, do they make an archive you can trust with contracts, invoices and personnel files.

To see how CONTMAN Archive works with document workflows, signatures and employee files, read our post on the CONTMAN document management system. Book a demo of CONTMAN Archive, and we will show you how category encryption, roles and document history work in practice.