Security and privacy are fundamental pillars of OQENS. We enforce a strict multi-tenant security architecture that guarantees complete logical and physical isolation of data across all workspaces and tenants.
Every user is assigned a completely isolated storage directory associated with their unique username. Files uploaded under one tenant workspace can never be scanned, accessed, or tampered with by another tenant.
All database lookup keys and API tokens are dynamically mapped to specific tenant records. When requests hit the OQENS API gateway, we validate credentials and programmatically restrict the runtime environment to that tenant's namespace, ensuring directory traversal attempts are instantly caught and blocked.
OQENS never merges uploaded files into a single flat bucket. By maintaining separate filesystem handles at the Linux disk level, we ensure that files are kept physically segmented, preventing data leakage, catalog mix-ups, or cross-tenant cache contamination at the CDN routing level.