fileVault keeps the bytes in cheap object storage, the permissions in a group tree, and hands each request a short-lived presigned URL. Sign in with your existing account — permissions follow the groups you are already in.
Identity comes from your existing sign-in. Authorization is resolved per request against a group tree you control, so a folder shared once keeps working as people join and leave.
Grant access on a folder and everything inside it inherits — files, sub-folders, whatever gets added later. No per-file bookkeeping.
Build sub-groups under a parent team. Access granted to Sales reaches Sales-East; access granted to Sales-East stays there and never leaks upward.
Mark a folder or file public and hand out a link that needs no account at all. Every anonymous view and download is logged, classified, and charted.
Mint a bearer key scoped to one folder for a script, a CI job, or an agent. Shown once at creation, revocable at any time, never able to exceed its scope.
Attach a description and custom fields to any item, and tag resources across folders so one list can cut through the whole tree.
A hosted MCP endpoint exposes the same operations as the dashboard, behind the same permission checks — no second authorization path to drift out of sync.
Bytes go straight from your browser to object storage. This server only decides whether you are allowed, then signs a URL that expires.
Create folders and drag files in. Uploads go directly to object storage over a presigned URL, so large files are not limited by this server.
Point a group at a folder and pick read, write, or admin. Everyone in that group — and every sub-group under it — can reach it immediately.
Send a link. Teammates sign in and see exactly what they were granted; an outside recipient gets a public share link or a scoped access key.
Every one of them resolves through the same check on every request — there is no bypass path, and no route that trusts the caller because of where the request came from.
| Level | Who it reaches | Sign-in required |
|---|---|---|
| Group grant | A named group and every sub-group under it, at read, write, or admin. | Yes |
| Everyone | Any signed-in user on the platform — an internal-wide share, not a public one. | Yes |
| Public | Anyone with the link, read-only, cascading to everything inside the folder. | No |
| Access key | One script or agent, scoped to one folder, at the permission you chose. | No — bearer key |