Databunker Pro File Storage Demo ✔️

Databunker Pro: File Storage Demo

This example demonstrates how to store customer documents — passports, utility bills, contracts — as encrypted files attached to a user record. It shows how to:

Attach Files to a User: Store documents encrypted with a per-file key wrapped by that user's record key
Tag by Document Type: Label files so you can find them without relying on filenames
Filter and Retrieve: List a user's documents by tag and decrypt them on demand
Crypto-Shredding: Delete the user and every attached document becomes unrecoverable

ℹ️ All requests are executed in the sandbox environment (show/hide configuration).

Step 1: Create the User Record

Files are always attached to a user, so start by creating one

// Create the user that will own the documents
const user = await api.createUser({
    email: 'john@filedemo.com',
    name: 'John Doe'
});
window.demoUser = user;
return {
    user,
    note: "Every file is attached to this user and encrypted under that user's record key"
};

Step 2: Upload an Encrypted Document

Store a passport scan, tagged by document type

// File content is supplied as base64 in the filedata field
const filedata = btoa('fake passport scan bytes');
const passport = await api.createFile(
    'email',
    'john@filedemo.com',
    'passport.jpg',
    filedata,
    { tags: ['passport', 'kyc'] }
);
window.passportFile = passport;
return {
    passport,
    note: "Tags are lowercased, de-duplicated and sorted on write, so they come back in a different order than they were sent"
};

Try it free — startups get $1,000 in credits

If you're an early-stage startup, we'll give you $1,000 in credits — enough to run Databunker Pro completely free for your first couple of months. Book a short setup call and we'll get you started and apply the discount automatically.

Book 15-Min Setup Call

Step 3: Upload a Second Document

Add a proof-of-address document so there is something to filter

if (!window.demoUser) {
    throw new Error('Please run Step 1 first to create the user');
}
const bill = await api.createFile(
    'email',
    'john@filedemo.com',
    'utility-bill.pdf',
    btoa('fake utility bill'),
    {
        mimetype: 'application/pdf',
        tags: ['proof-of-address', 'kyc']
    }
);
window.billFile = bill;
return {
    bill,
    note: "Both documents carry the shared 'kyc' tag, and each carries its own document-type tag"
};

Step 4: List the User's Documents

Return metadata only — filenames are decrypted for the response, content is never exposed by a listing

const listing = await api.listUserFiles('email', 'john@filedemo.com');
return {
    files: listing.files,
    summary: listing.files.map(f => `${f.filename} [${f.tags}]`),
    note: "This returns metadata only. File content stays encrypted until you explicitly fetch it."
};

Step 5: Filter Documents by Tag

Find which documents a profile already has — useful for KYC completeness checks

// Pass a single tag to narrow the listing
const proofOfAddress = await api.listUserFiles('email', 'john@filedemo.com', 'proof-of-address');
const passports = await api.listUserFiles('email', 'john@filedemo.com', 'passport');
return {
    proofOfAddress: proofOfAddress.files.map(f => f.filename),
    passports: passports.files.map(f => f.filename),
    note: "Tags are stored unencrypted so they can be indexed — use them for document types, never for personal data"
};

Step 6: Retrieve and Decrypt a Document

Fetch a file by its uuid and decode the content

if (!window.passportFile) {
    throw new Error('Please run Step 2 first to upload the passport');
}
const fetched = await api.getFile('email', 'john@filedemo.com', {
    fileuuid: window.passportFile.fileuuid
});
return {
    filename: fetched.filename,
    mimetype: fetched.mimetype,
    tags: fetched.tags,
    decrypted: atob(fetched.filedata),
    note: "The MIME type was detected from the file content on upload. Pass 'raw: true' to download the decrypted bytes directly instead of base64 JSON."
};

Step 7: Retag a Document

Replace the complete tag set on a file — for example when a document is superseded

if (!window.passportFile) {
    throw new Error('Please run Step 2 first to upload the passport');
}
// This replaces the tag set outright, it does not merge
const retagged = await api.replaceFileTags(
    'email',
    'john@filedemo.com',
    window.passportFile.fileuuid,
    ['archived']
);
// The passport no longer carries the kyc tag
const stillKyc = await api.listUserFiles('email', 'john@filedemo.com', 'kyc');
return {
    retagged,
    remainingKycDocuments: stillKyc.files.map(f => f.filename),
    note: "replaceFileTags overwrites the tag set. The passport dropped out of the kyc listing."
};

Step 8: Find Documents Across All Users

Look up every file carrying a tag, tenant-wide, gated by a bulk-unlock uuid

// Bulk listing is default-deny and requires an explicit unlock first
const unlock = await api.bulkListUnlock();
const tagged = await api.bulkListFilesByTag(unlock.unlockuuid, 'kyc', 0, 10);
return {
    tagged,
    note: "Each row carries the owning user's token rather than their personal data. The unlock uuid expires after 60 seconds."
};

Step 9: Crypto-Shredding

Delete the user and every attached document goes with it

if (!window.demoUser) {
    throw new Error('Please run Step 1 first to create the user');
}
// Deleting a single file removes just that document
const fileDeleted = await api.deleteFile(
    'email',
    'john@filedemo.com',
    window.billFile.fileuuid
);
// Deleting the user destroys the record key that wrapped every file key
const userDeleted = await api.deleteUser('email', 'john@filedemo.com');
let gone = false;
try {
    const check = await api.listUserFiles('email', 'john@filedemo.com');
    gone = check.status === 'error';
} catch (error) {
    gone = true;
}
return {
    fileDeleted,
    userDeleted,
    documentsStillReachable: gone ? "No — user and all documents are gone" : "Yes",
    note: "The encryption key is destroyed with the record, so the stored ciphertext can never be decrypted again"
};

Next Step

See Databunker Pro in Action

Book a 15-min setup call and we'll get Databunker running for you in minutes. No technical work required on your end.

Book 15-Min Setup Call