File security & virus protection

5 Min. readContinuously maintained · Beta· Uslimato Docs

Every file uploaded into Uslimato — model image, ticket attachment, profile picture — is checked, sanitised and scanned for malicious code before it is stored. The protection is always on and can neither be switched off nor configured.

#What happens on upload

Type check — the declared file type has to be permitted for this upload at all
Content check — the actual file content has to match the declared type. A renamed PDF carrying a .png extension is detected and rejected
Sanitisation — the file is rebuilt rather than merely inspected: - Images are re-encoded; EXIF data and anything else embedded falls away - PDFs are reconstructed, with active parts such as embedded scripts removed - Office documents are checked for macros and suspicious compression patterns
Virus scan — the sanitised file is scanned for malware, archives including their contents
Storage — only after a clean scan is the file written at all

A detected threat means the upload is rejected and the file never lands in your tenant. You get an unambiguous error message.

Note

Step 3 is why Uslimato rebuilds files rather than just scanning them. A scanner only knows what is already known. A rebuilt image or PDF simply no longer contains the active parts — regardless of whether a signature for them exists.

#Automatic updates

Virus definitions update automatically several times a day. New threats are typically recognised within hours of being published. You have to do nothing for that.

#Fail-closed

Uslimato follows a strict fail-closed principle: if the scanner is temporarily unavailable, uploads are rejected until it is ready again. There is no way to bypass the scan — not for administration either.

No file is ever accepted without being scanned first. If the scanner is down you see a message saying so and try again shortly after; administration is notified automatically, at most once per hour.

#Limits

Limit	Value
Maximum size of a single file	25 MB, regardless of plan
Storage per tenant	Depends on the plan

Which file types are permitted depends on the context — for a model image, only image formats. The virus scan runs either way, whatever the type. The list for tickets is in Ticket attachments.

#Nothing to set up

There is no setting to enable — neither for users nor for administration. The protection is part of the platform, not a module you can forget to buy.

Was this helpful?

Suggest an edit