Secure document delivery is a chain, not one checkbox. A private customer assignment is useful, but it does not replace server rules. A password adds friction, but it does not decide who should receive the link. Good protection combines identity, document policy, storage, and traceability.
1. Start with the audience
Choose the narrowest useful audience for every file:
- One customer for contracts, project reports, and individual certificates
- A customer group for dealer manuals or wholesale documentation
- A product assignment for shared technical material
- Public access only for documents intended for anyone
Avoid making a document public merely because the recipient has trouble logging in. Fixing account access is safer than weakening the document rule.
2. Add time and download limits where they have meaning
Validity dates work well for temporary tenders, expiring certificates, and campaign documents. A maximum download count can be appropriate for controlled hand-offs, though it should not be mistaken for digital rights management. A customer may still save and copy a file after a legitimate download.
3. Use passwords selectively
Password protection is helpful for a public link shared with a known recipient or for an extra check on sensitive account files. Send the password through a different channel when the document justifies it. Password-protected files should remain separate from bulk ZIP downloads, which is how SoftwareSilo handles them.
4. Protect the storage path
SoftwareSilo resolves frontend downloads from a document ID and can obfuscate filenames. The stronger step is to block direct web access to the storage directory in Apache or Nginx. The application route should perform the customer, group, date, password, and download-limit checks before serving a file.
Filename obfuscation reduces guessing. It is not a replacement for the web-server block.
5. Restrict external destinations
External URLs are convenient when another system stores the file. Maintain an allowlist of trusted hostnames so a bad or mistaken record cannot redirect customers to an arbitrary site. Review ownership, authentication, expiration, and logging on the external service as well.
6. Keep file handling predictable
Set allowed extensions and a maximum upload size. Limit email attachments separately because mail servers often reject messages long before the application upload limit is reached. Use the account link for large files.
Enable missing-file cleanup only after confirming that the configured storage path and deployment process are stable. A cleanup job should remove stale records, not mask a broken mount.
7. Review reports and responsibilities
Download reports answer whether the application served a file. They do not prove that the recipient read it or that the file was never shared. Decide who reviews reports, who revokes access, and who owns document expiry. Those operational choices make the controls useful.
A sensible baseline
For private customer files, use account or group assignment, server-level directory blocking, permitted file types, explicit validity where required, and download reporting. Add passwords and download limits when the business case calls for them. Keep public links exceptional and external domains allowlisted.
Source
Last reviewed: August 9, 2026.