Any cloud, any bucket, one API

All storage operations go through the `StorageProvider` protocol. Service code never imports S3Client, BlobServiceClient, or any provider SDK directly — only the injected provider interface.

Each project stores its storage provider, bucket/container name, region, and credentials in the FileNest database. Switching a project to a different bucket is a config change, not a code change.

Enterprise tenants can supply credentials to their own S3 bucket, Azure container, or GCS bucket. FileNest manages the presigned URL lifecycle without ever touching the storage provider credentials client-side.

Files larger than 100 MB automatically switch to multipart upload. FileNest coordinates part URL generation, parallel part upload, and final assembly — the SDK handles retry logic per part.

SSE-S3 by default. Projects with HIPAA controls enabled enforce SSE-KMS with a customer-managed key. The encryption mode is validated when a project's compliance configuration is saved.

Files can be moved between storage providers server-side via a COPY+DELETE operation coordinated by FileNest. The file record's storage key is updated atomically — client applications see no downtime.