Uploaded production files are stored in private Cloudflare R2 object storage rather than the public website repository. Access is routed through token-controlled endpoints linked to the RFQ. These controls reduce casual exposure, but no internet service can promise absolute security and the website does not claim that every access token expires within a specific short period.
Current website controls
The RFQ service separates public website assets from customer uploads, validates supported filename extensions and size limits, and uses project access tokens for file operations. File responses are intended for authorized quotation and engineering workflows.
- Private object-storage bucket
- Random project access token stored as a hash
- Same-origin checks on website API requests
- Bounded file types, file count, per-file size, and total size
- No public directory of uploaded production files
Customer-side handling still matters
Keep the original package in an approved system, share project links only with authorized recipients, and report suspected exposure promptly. Agree a different workflow before upload if your policy requires named users, customer-managed encryption, a fixed token lifetime, access logs, or other controls not stated here.
Next useful step
Final capability, commercial terms, and project records are confirmed against the actual RFQ and written project documents.