# File Upload Security {#file-upload-security}


Security controls for file uploads in Ever Gauzy.


## File Validation {#file-validation}



### File Type Restrictions {#file-type-restrictions}


Uploaded files are validated by:

- **MIME type** — checked against an allowlist
- **File extension** — validated against permitted extensions
- **File size** — enforced maximum size limits


### Allowed File Types {#allowed-file-types}


| Category  | Extensions                                       |
| --------- | ------------------------------------------------ |
| Images    | `.jpg`, `.jpeg`, `.png`, `.gif`, `.svg`, `.webp` |
| Documents | `.pdf`, `.doc`, `.docx`, `.xls`, `.xlsx`         |
| Archives  | `.zip`                                           |


## Storage Security {#storage-security}


| Measure          | Description                      |
| ---------------- | -------------------------------- |
| Tenant isolation | Files scoped to tenant directory |
| Unique naming    | Files renamed to UUIDs           |
| No execution     | Upload directories have no-exec  |
| Access control   | Files served through API auth    |


## Configuration {#configuration}


| Variable        | Description                 |
| --------------- | --------------------------- |
| `FILE_PROVIDER` | Storage backend             |
| `MAX_FILE_SIZE` | Maximum upload size (bytes) |


## Related Pages {#related-pages}


- [Image Asset Endpoints](https://sourcey-gauzy.pages.dev/api/image-asset-endpoints/index.md) — upload API
- [Input Validation](https://sourcey-gauzy.pages.dev/security/input-validation/index.md) — validation patterns