Data encryption
At rest and in transit, with keys managed apart from the content. Stolen media yields no documents, only bytes.
One barrieralways gives way eventually.
Constellio protects your documents in layers: encrypted at rest and in transit, scanned on every deposit, logged on every action, and restorable to a precise moment. One layer falling does not open the next.
- Encrypted at rest and in transit
- Malware scanning on deposits
- Backups and disaster recovery
HOW IT WORKS
Encrypt. Filter. Restore.
Three defences that don’t depend on each other.
Protection that rests on a single mechanism is protection with a single point of failure. These are independent: each one holds even if the one before it has been crossed.
- 01 Encrypt
Unreadable anywhere else.
Documents are encrypted on the media and on the wire. Outside Constellio and its permissions, a file is a block of bytes, including for anyone who reaches the disk.
- Encryption at rest and in transit
- Keys managed and rotated
- Readable only by those entitled to it
- 02 Filter
Nothing gets in unexamined.
Every deposit is scanned before it reaches the repository. Anything suspicious goes to quarantine instead of being filed, and whoever uploaded it finds out immediately.
- Malware scanning on every deposit
- Quarantine instead of filing
- Uploader and administrator both notified
- 03 Restore
The worst happens anyway.
Regular backups, off-site copies and restore points: content deleted, overwritten or encrypted by ransomware is brought back to the state it was in before.
- Dated restore points
- Backups kept off site
- Disaster recovery plan
What is encrypted stays unreadable even if somebody gets hold of the media: the next layer doesn’t have to be perfect.
FOUR LAYERS, ONE DOCUMENT
What it would take
to reach one of your files.
Follow one site quote while people try to reach it. Each step adds a defence to the record and a line to the security log, and the second one shows what happens when something bad knocks at the door.
- 01Encrypted
On the disk, it isn’t a document.
The content is encrypted at rest and in transit. Anyone getting a copy of the media would not get the document: they would be missing the key, managed separately and rotated regularly.
- Encryption at rest and in transit
- Keys managed apart from the content
- Decrypted only for an authorized reader
- 02Filtered
Malware turns up, and doesn’t get in.
Every upload is scanned before filing. The infected file goes to quarantine, never appears in the repository, and the incident is reported to the uploader and the administrator alike.
- Scanned before filing, not after
- Quarantine isolated from the repository
- Reported immediately on both sides
- 03Logged
Every move leaves a line.
Opens, edits, shares, refused attempts: all recorded with who, when and from where. This log is the evidence when a regulation requires you to show who saw what.
- Who, when and from where on every action
- Refused attempts recorded too
- A log an auditor can actually work from
- 04Restorable
And if all of it fails, you go back.
Backups are kept off site and can be replayed to a precise moment. An accidental deletion, an overwrite or ransomware leaves no permanent hole in the repository.
- Dated restore points
- Off-site copies, out of reach
- Disaster recovery that has been tested
Security consoleMonitoring active
Structural quote 2026.docxPublic works › Quotes · v7
Protections in place
- EncryptedAES-256 · TLS 1.3
- Scannedon deposit
- Loggedevery action
- Backed upoff site
Content on the media
8f2a 41d7 0c93 be55 7a1e d0f4 22b8 9ce6 5310 aa7f 6b21 ef08 94cd 1a63 7f42 b0d9 c7e5 3846 12fa 9d70 68b3 25ce af14 5209 Key · managed separately · rotated 1 March
Quarantine
invoice_scan.exe
Malware found on upload: the file never reached the repository
See the scan reportAudit log
- 09:14ViewedS. Nadeauoffice
- 10:02Edited · v7S. Nadeauoffice
- 11:47Shared internallyM. Tremblayoffice
- 14:31Open attemptRefusedexternal accountoff network
Restore points
- 14 March 03:00full backup
- 15 March 03:00incremental
- 16 March 03:00incremental
Restore to this point
Off-site copies · recovery tested quarterly
REAL-WORLD USE CASES
The share nobody dares make,
and the day everything has to come back.
Two situations where security stops being a paragraph in a contract: working with outsiders without opening the repository, and going back in time after an incident.
For work with outsiders
Collaborate without opening the repository.
Documents are shared with partners without a copy emailed out and without an account created in your directory. The link is encrypted, dated, revocable, and every open leaves a line in the log.
See access management
For sensitive data
Back to yesterday morning.
Health records, employee files, court exhibits: the content whose loss costs the most and whose leak costs more. Encryption, logging and off-site backups answer all three of an auditor’s questions.
See compliance managementWhat the platform applies to security
- Multi-factor authentication
- Customizable access control
- Data encryption
- Audit and traceability
- Malware protection
- Backups and recovery
Six mechanisms, four layers
IN DEPTH, NOT IN WIDTH
Four layers to cross.
Holding one of them isn’t enough.
The other diagrams on this site follow content that moves. This one doesn’t move at all: your documents sit in the middle, and everything coming from outside has to cross layers that don’t depend on each other. Most attempts stop well before the centre.
Malware protection
Every deposit is scanned before filing. Anything suspicious goes to quarantine and never reaches the repository or the people who read from it.
Audit and traceability
Every action and every refusal leaves a dated, attributed line: what an auditor asks for, and what a regulation like the GDPR requires.
See access managementOUR KEY FIGURES
Fewer doors.
Fewer things to watch.
Most incidents don’t come from a sophisticated attack but from a file in the wrong place. One repository, encrypted and logged, removes half the opportunities.
Figures published by Constellio01
0
Reduction in search time
02
0
Reduction in search costs
03
0
Reduction in security incidents
Why choose Constellio
Security
A high level of protection on your sensitive data, with the confidentiality of your information held up by several independent mechanisms.
Compliance
Audit and traceability features answer data protection regulations, the GDPR included.
Collaboration
Share and work on documents with colleagues and partners without leaving the perimeter.
Productivity
Access to information stays fast: security applies without adding a step for the people entitled to read.
Organizations running on Constellio
YOUR PERIMETER
Unlock the potential
of your content.
Book a demo and walk the four layers with your security team: encryption, scanning, access control and recovery, on your own content.
Or write to contact@constellio.com. Open source at its core, hosted the way you want it.
