Storage
Azure Blob with user-delegation SAS, Google Cloud Storage V4, and S3-compatible SigV4, including optional custom endpoints.
Architecture
How Trustholm Bridge worksYour cloud, your identity
Control plane on Trustholm. Data plane in your tenancy. Signed upload and download URLs are minted. File bytes stay in your cloud.
Staff and guests use a branded portal. Trustholm stores workflow metadata and audit. Your object storage holds the files. Your IdP holds workforce identity. Optional scanners and SIEM stay in tools you already run.
BYOS mint-only · Blob, GCS, and S3 · White-label portal · SIEM audit
The pitch, as an invariant
Your files stay in your cloud. Your identity stays in your IdP. We orchestrate.
That is the golden path for Trustholm Bridge. Every feature has to pass two tests. First, does this put customer file bytes, or full-content extracts, onto Trustholm infrastructure? If yes, it is redesigned. Second, does adding a new customer cloud require rewriting routes and onboarding? If yes, the cloud leaked out of the adapter.
The result is a white-label secure file exchange: share, file-request, and workspaces. Closest peer is Kiteworks. Files at rest stay in storage you already operate.
What each plane holds
The control plane is a Cloudflare Worker with metadata in Neon. It holds workflow config, policy, audit metadata, UI, billing, and envelope-encrypted connector secrets for storage and IdP. That is credential custody, not file-byte custody.
The data plane is yours: Azure Blob with user-delegation SAS, Google Cloud Storage with V4 signed URLs, or S3-compatible storage with SigV4 (including optional custom endpoints such as MinIO). Browsers upload and download directly to that storage after the Worker mints a short-lived URL.
0. Guests prefer Microsoft or Google work login, then a one-time email code to the invited mailbox.
Passkey and TOTP cover guest MFA and staff step-up.
What may persist in the control plane: filename, size, content-type, object key, optional content hash, timestamps, actor, auth method, IP, user-agent, ACL, expiry, max downloads, classification label, scan verdict plus engine name, and hashed invite tokens. File bytes at rest stay in your object storage.
Share, file-request, and workspaces in practice
A staff user authenticates to the branded portal, creates a share, a file-request, or a workspace, sets expiry, max downloads, watermark or view-only where needed, and invites guests. Guests prove identity with work login when they have it, a one-time email code to the invited mailbox, or passkey / TOTP when you require MFA.
The Worker authorises the action, writes audit, and mints storage access. Every invite is a deliberate grant.
A workspace is a governed deal room. Internals and externals browse and contribute. Each replace is a new revision and a re-scan.
File-request accepts folder upload as well as files.
When a share, file-request, or workspace expires, the link stops working. Bridge then deletes the objects from your bucket after the delay you set. Legal hold on the tenant or the share skips that erase.
You can require information markings (AU PSPF, HIPAA PHI, or US CUI). Banners show on the app, claim page, viewer, and email. Markings are labels. They are not a certification.
Malware scanning can quarantine before promote. The default engine is platform MetaDefender. You can bring a customer webhook engine or Defender Event Grid ingest so scan verdicts stay on a path you already operate. Local DLP covers extension, MIME, and regex gates.
View-only uses a short-lived inline SAS after a one-shot view token. Watermark is a deterrent and an attribution aid.
Audit your SIEM can actually use
Access, ACL changes, auth events, and admin actions are retained in a hash-chained audit log. You can export CSV and stream to Microsoft Sentinel, Splunk HEC, a signed webhook, or GCP Pub/Sub. SIEM replay is part of the product.
Metadata residency: the login hub is bridge.trustholm.com. Product cells run at us, au, and eu.bridge.trustholm.com. That is a control-plane residency choice you can name in an architecture pack.
This is the diligence conversation: who opened what, when, under whose authority. Retention and legal hold apply to shares. A hold skips erase after expiry.
What this product is for
Bridge is branded share, file-request, and workspaces with files in your cloud. Staff and guests use a portal that presents as your organisation. Browsers upload and download on short-lived signed URLs. You keep object storage, identity, and SIEM.
Read the overview for the conversion story, then pick a client path or a compare page if you are leaving a named tool.
Adapters for the first ICP
Cloud-specific code belongs in adapters. Routes and onboarding speak capabilities: mint an upload URL, start IdP login, deliver an audit event, scan a quarantine object.
Identity
Entra, Google Workspace, and SAML 2.0 for workforce. Guests use work login, a one-time email code, or passkey / TOTP when you require MFA.
SIEM
Sentinel, Splunk HEC, webhook, and GCP Pub/Sub, including replay.
Scan
MetaDefender Cloud default, customer webhook, or Defender Event Grid ingest. Local DLP gates on extension, MIME, and regex.
What you get
In the product
- BYOS mint-only to customer Azure Blob, GCS, or S3-compatible storage
- Entra, Google Workspace, and SAML workforce federation
- Guest access: Microsoft or Google work login, email one-time code, then passkey / TOTP when you require MFA
- Share, file-request (including folder upload), and workspaces with expiry, max downloads, revoke, watermark, then BYOS erase unless legal hold is on
- Malware quarantine plus Defender Event Grid or webhook path; local DLP gates
- Hash-chained audit, CSV export, and SIEM stream including replay
- White-label hostname, theme, multi-tenant, SCIM, retention, and legal hold on shares
- Information markings: AU PSPF, HIPAA PHI, and US CUI labels (not a certification)
- US / AU / EU metadata cells behind the login hub
What you can show
- Files at rest in the storage account your architecture board already accepts
- Staff identity in the IdP you already operate
- Guest access with MFA you can invite and revoke
- Hash-chained audit in Sentinel, Splunk, webhook, or Pub/Sub
- A named US, AU, or EU metadata cell for control-plane residency
- White-label hostname and theme on the portal partners see
- Malware quarantine on a scan path you choose
- Retention and legal hold on shares. A hold skips erase after expiry
Want this walked with your storage and IdP in the room?
Request Bridge access. We scope Blob, GCS, or S3, Entra or Google or SAML, brand, cell residency, and what good audit means before the first production guest.
Frequently asked questions
- Where do file bytes live?
In your Azure Blob, GCS, or S3-compatible bucket. Browsers talk to that storage with minted URLs. Trustholm keeps workflow metadata and audit.
- Which clouds are shipped?
Azure Blob, Google Cloud Storage, and S3-compatible object storage for files. Entra, Google Workspace, and SAML for identity.
- How is access minted?
Workforce identity stays in your IdP. Guests use Microsoft or Google work login, a one-time email code to the invited mailbox, or passkey / TOTP when you require MFA. Storage access is a short-lived signed URL. Call it mint-only BYOS with audit.
- Can we keep malware scanning inside our tenancy?
Yes. Bring a customer webhook engine or Defender Event Grid ingest off the MetaDefender default. Confirm during onboarding.
- Does white-label mean our own hostname?
Yes. Customer hostnames CNAME to the Bridge customer apex. Staff and guests stay on that hostname. Theme and email identity are part of the white-label offer.
- Does expiry delete the files?
Yes, after the delay you set. The link stops first. Bridge then deletes the objects from your Blob, GCS, or S3. Default is the next daily job. Legal hold on the tenant or the share skips that erase.
- How does this support an agency or enterprise assessment?
Files stay in storage you already operate. AU, US, and EU cells name control-plane residency. Information markings (AU PSPF, HIPAA PHI, US CUI) are labels with banners. They are not a certification. We supply architecture and shared-responsibility material for your assessor. Classification stays with you.