How QCDS Protects Source PDFs, Requests, Completed Files, and Attachments

QCDS keeps signing documents and evidence behind application-controlled storage and delivery rather than ordinary public file URLs. Protection combines outside-webroot storage, workspace authorization, immutable object/version references, server-side validation, and SHA-256 integrity checks.

Managed Private Storage Is Outside Joomla Webroot

QCDS requires Managed Private Storage to resolve to an absolute server path that is provably outside the Joomla document root. It refuses a root inside webroot, an ancestor of webroot, unsafe symbolic-link paths, or a location without a writable outside-webroot ancestor.

Stored objects use randomized application object keys. Writes are atomic, bounded by size, and checked again for byte size and SHA-256 after the final rename. Immutable objects cannot simply be overwritten in place.

Source PDFs Enter Through Quarantine

New document uploads are first written to the quarantine lifecycle. QCDS performs server-side file validation using detected content, then runs the configured document safety inspection. Invalid or infected files are rejected. If scanning is unavailable/timeout, the configured policy either holds the file safely in quarantine for retry or fails closed.

Only a validated, safety-cleared object is promoted to active immutable private storage and accepted as a signing-document source. QCDS currently accepts PDF document sources for Templates.

Sent Requests Point to Exact Frozen Objects

Send Now freezes the Request snapshot and references the exact document/storage objects used by the transaction. Later source or Template versions do not replace those references.

During completion QCDS rechecks the frozen source PDF SHA-256 and the protected normalized page-render hashes before composing the Completed PDF.

Completed Files and Attachments Are Verified Again

QCDS verifies Completed PDF structure, size, page composition, and SHA-256 before storing the artifact as an immutable completion object, then confirms the stored object's SHA-256 still matches the generated file.

Signer attachment originals are likewise resolved from protected storage and verified against the SHA-256 recorded in the final signer value before they are used in a Completed PDF or Completed Package.

Downloads Go Through Authorization

Authenticated Joomla-user preview/download requests require a valid session token and workspace/object authorization. Signer-session delivery is even narrower: QCDS permits only the exact protected document/image/completed objects authorized by that verified signer session and frozen Request context.

Protected streams use private/no-store caching controls, MIME sniffing protection, no-referrer behavior, and restrictive inline-preview sandboxing. Do not copy QCDS private-storage files into a public web folder to make them easier to reach; use the QCDS preview/download paths so authorization and delivery evidence remain in control.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDS feature? Visit the QC Digital Signature Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.