Skip to main content

Object Storage

S3-Compatible Object Storage – Ceph​

The DEUSS platform uses S3-compatible object storage (Ceph) as the binary storage layer for all unstructured and document data. All objects are accessed via pre-signed S3 URLs through controlled backend services — direct client access to buckets is not permitted.

For document classification, governance policies, and retention rules, see Document Management.

Bucket Design​

Buckets are separated by ownership domain to enforce access control and sensitivity boundaries:

Bucket ownerTypical contentSensitivity
DEUSS CoreMarketing content, bond documents, public assetsLow – public/partner
Broker PlatformTemporary draft uploads during onboarding / bond creationMedium – short-lived, TTL enforced
Distributor (Validator)KYC/AML materials, signed contracts, audit evidenceHigh – strictly access-controlled

Rules:

  • each application domain has its own dedicated bucket — cross-domain bucket access is not permitted
  • bucket names and prefixes must reflect ownership and sensitivity boundaries
  • Distributor / Validator buckets must support stricter segregation for sensitive compliance materials
  • applications access objects through backend services using short-lived pre-signed URLs

Access Patterns​

  • Read: backend generates a short-lived pre-signed GET URL and returns it to the client
  • Write: backend generates a short-lived pre-signed PUT URL; the client uploads directly to S3 without the binary passing through the backend service
  • Direct, unmanaged cross-domain bucket access is not allowed at any layer

Retention and Lifecycle​

  • DEUSS Core: no mandatory retention — objects may be versioned and archived
  • Broker Platform draft buckets: TTL lifecycle policy (e.g., 72 hours); objects deleted automatically after expiry
  • Distributor buckets: retention enforced per applicable regulatory jurisdiction; legal hold support recommended