Isolation and evidence
No single mistake collapses the wall between two dealers
Separation is enforced in four independent layers. Each would have to fail on its own.
-
Jailed mailboxes.
Each dealer is locked to their own directory and can see nothing above it — not your root, not a sibling dealer. Your account sees every one of your dealers and no other company's.
-
Asymmetric permissions.
Granted per folder, and deliberately not symmetrical. A dealer can read what you send but cannot delete it, and cannot write into the outbound folder at all. So a dealer can neither destroy a document you sent nor forge one that appears to come from you.
-
Database-enforced tenancy.
Separation is enforced by the database itself through row-level security, not by application code remembering to filter. A query that forgets a tenant returns nothing rather than someone else's data.
-
Hardened naming.
Every account and folder name is validated before use — a restricted character set, no traversal sequences, no leading dashes, length-bounded. Paths are assembled from already-validated parts rather than normalised after the fact.
Nothing is written to a live mailbox without you seeing it first
Confirm before writing.
Provisioning, credential rotation and suspension all route through one confirmation listing every value that will be written, with a count.
Per-partner address restrictions.
A mailbox can be limited to the network addresses you nominate, so a leaked credential is not enough on its own to connect.
Drift detection.
The system compares what it believes exists against what the file server actually has, reports any divergence, and can roll forward. It reports rather than deletes — the one repair that cannot be undone is never automatic.
Credential management.
Mailbox credentials are issued and rotated as a first-class operation, by password or key, without disturbing anything else about the partner.
The database is the archive, not the disk
Mailbox files are transient. A completed document is deleted at pickup, and retention purges anything left at day fourteen. Every screen reports on rows, timestamps and archived acknowledgements — never on what happens to be sitting in a folder.
Every transfer is written to an append-only audit trail with the real source address. Both the file you sent and the document generated from it are retained with a content fingerprint, so you can prove what you sent.