A customer file is not a brochure. The default for briefs, IDs, and delivery archives is a private store and a link that expires.
Do not trust the name
Store a generated key and the original filename separately. The content type a browser sends is a hint, not a verdict. Limit size before the file reaches disk, and reject types you have no reason to keep.
Authorize the download
The URL that fetches the file should check the same permission as the page that lists it. A guessable path is a listing you did not mean to publish. Signed URLs with a short life are enough for a delivery the client downloads once.
Scan and retain on purpose
If you promise to delete source documents after transcription or after a case closes, write the job that does it and test it. An inbox that grows forever becomes both a cost and a liability.
What to do this week
- Cap upload size and store a generated key.
- Check permission on every download.
- Write the retention job you already promised.