Private object storage
Original creative files live in private object storage rather than a public media bucket.
Security
Asset security starts with the architecture.
MP BrandDock is designed so authentication, tenant permissions, metadata and private file storage reinforce each other instead of relying on secret folder URLs.
Tenant isolation
Each client workspace is an explicit data boundary with membership-aware authorization and database row-level security.
Short-lived file access
Preview and download access is issued only after authorization and expires automatically.
Role-based capabilities
Agency admins, agency managers, client admins and client viewers can have different actions available.
Immutable versions
Replacing a file creates a new asset version so prior binaries and decisions can remain traceable.
Audit events
Downloads, approvals, uploads and other sensitive actions can be recorded without logging credentials or signed URLs.
Infrastructure model
Separate the file from the permission to access it.
Distinct layers for identity, application data and binary objects keep a file path from becoming the security boundary.
After authorization, protected file delivery uses short-lived signed access rather than exposing permanent public links.
Defense in depth
Client isolation should be enforced more than once.
The application layer scopes requests to a tenant, and PostgreSQL row-level security provides an additional boundary around protected records.
- Protected queries resolve a tenant explicitly.
- Membership and role checks gate sensitive actions.
- Database policies restrict tenant-scoped rows.
- Object keys are opaque identifiers, not access credentials.
- Sensitive server credentials remain server-only.
Who is this user?
What tenant and capabilities can they access?
Which records can their session read or change?
Which protected object may be delivered right now?
Operational readiness
Security also means reliable lifecycle controls.
Background processing
Preview generation, archive creation and malware-scanning hooks can run outside the request path with retryable jobs.
Observability
Error monitoring and audit events can provide operational context without exposing tokens or signed URLs.
Revocation
Share-link state stays in application data so an expired or revoked link can stop resolving immediately.
Security review
Request a walkthrough →Need to review MP BrandDock for your organization?
We can walk through the current architecture, permission model, storage design and planned production controls.