Passport scans, ID selfies and signed contracts end up in an S3 bucket with IAM rules set once and forgotten. Databunker Pro encrypts each file under its own key and gates every download by policy.
AES-256
Per-file encryption
Every access
Logged and attributable
30d – 1y
Retention enforced by the vault
The Challenge
Identity verification, underwriting and HR onboarding generate files far more sensitive than the rows beside them — and object storage nobody reviews is where they land. Bucket policies drift, and the filename itself leaks the contents.The Solution — Four Capabilities
1. Per-file encryption
Each file gets its own key, wrapped by the owning user’s record key.
2. Access control and tenant isolation
CRBAC decides who may upload, list and download; PostgreSQL row-level security keeps tenants apart.
3. Retention without a cleanup job
slidingtime gives a rolling window (30d, 1y); finaltime an absolute cutoff — enforced by the vault.
4. Tags instead of filenames
Retrieve a passport scan by tag, with no filename advertising its contents in a bucket listing.
How It Works
Upload against a user identity; the returned UUID is what your application database stores.curl -X POST http://localhost:3000/v2/FileCreate \
-H "X-Bunker-Token: $TOKEN" \
-d '{"mode":"email","identity":"john@example.com","filename":"passport.jpg",
"tags":["passport","kyc"],"filedata":"<base64>"}'
→ { "status": "ok", "fileuuid": "dc42ae8d-0789-…" }Evaluate with docker run -p 3000:3000 --rm securitybunker/databunkerpro demo — demo mode, never real personal data.
The Payoff
- Answer who downloaded this, and when from one log.
- Keep KYC files out of buckets that surface on pen-tests.
- Pass the file-access section of any security questionnaire.
- Hand auditors one access trail across records and files.