Governance without the complexity
FileNest's compliance layer is configuration-driven. Turn on WORM, legal hold, HIPAA controls, or GDPR deletion workflows per project — no infrastructure code required.
Write-once read-many (WORM) commits a file permanently. Once committed, the file cannot be modified, overwritten, or deleted — even by administrators. Meets SEC Rule 17a-4, FINRA, and CFTC immutability requirements. Committed via API with an explicit reason and audit entry.
Place any file under legal hold with a reason string. Files on hold are exempt from all retention and deletion policies — including project-level purges. Holds are indefinite by default and can only be lifted via explicit API call with a recorded justification.
Set per-project retention periods in days, months, or years. Files expire automatically on the retention date — either soft-deleted (restorable for 30 days) or hard-purged. GDPR right-to-erasure requests honour legal holds and WORM status before acting.
A configurable processing pipeline stage scans file content for PHI (HIPAA-defined protected health information) and PII patterns before the file becomes available. Detected files can be quarantined, redacted, or flagged for review — all via project configuration.
Every mutation — upload, download, delete, legal-hold change, WORM commit, metadata update — writes a tamper-evident audit entry in the same database transaction. Logs include actor, organisation, project, IP address, user-agent, and a diff of changed fields. Exportable as NDJSON or CSV.
Enable HIPAA controls per project: mandatory audit logging, encrypted-at-rest enforcement, PHI detection, 7-year audit retention, and access logs. No code changes — all behaviour is driven by the project configuration stored in FileNest's database.