File Safety
Overview
Survanta allows users to upload files in certain contexts — such as attaching supporting documents to surveys or uploading media assets. The platform enforces strict file safety rules to protect all users and the platform itself from harmful file types and exposure of sensitive storage paths.
File Type Validation
The shared survey-question file pipeline validates files before accepting them. It uses the platform file-type catalog plus question-level allowed categories/types; other upload surfaces must be reviewed separately rather than covered by an absolute claim.
Permitted types include common document, image, and media formats used for legitimate survey and research purposes. The exact list depends on the context of the upload (for example, survey attachments may allow different types than user avatars).
File types that are never permitted include:
- Executable files (such as .exe, .dll, .bat, .sh, .ps1, and similar)
- Script files that can be interpreted directly by a server or browser
- Archive formats that could conceal dangerous content in some upload contexts
This validation is enforced on the server side. Changing a file's extension on your device before uploading will not bypass the check — the platform inspects the actual file content, not just its name.
Managed File Storage
Uploaded files are stored using managed paths maintained by the Survanta platform. This means:
- Raw file system paths are never exposed to end users or in any public-facing URL.
- All file access goes through a controlled layer that checks whether the requesting user is permitted to access the file.
- Files are referenced in the platform by managed identifiers, not by their location on disk.
This approach prevents path traversal attacks, where a malicious actor might attempt to access files outside the intended storage area by guessing or manipulating a path.
Access Control on Files
Each uploaded file is associated with the tenant that uploaded it. Access to the file is subject to the same permission rules that apply to all other tenant data:
- Users within a tenant can access only the files that belong to their tenant.
- Users in other tenants cannot access those files.
- Single-survey and portal respondents use token-, survey-, question-, and upload-bound routes. Viewer response files require the viewer's response-detail capability and a current association. Viewer tokens do not answer surveys.
File URLs
When a file needs to be referenced in the platform — for example, shown as part of a survey — the platform generates a managed URL. This URL:
- Is validated at access time against the route's user/token and current association; no universal time-limited-URL guarantee is claimed
- Does not reveal any internal storage path or structure
- Works only for users with the appropriate permission
Frequently Asked Questions
What happens if I try to upload a file type that is not allowed? The upload will be rejected with an error message explaining that the file type is not permitted. The file will not be stored.
Are uploaded files scanned for viruses or malware? The pipeline validates structural signatures/containers and rejects executable, script, HTML, SVG, macro, archive, and mismatch content according to its catalog rules. No antivirus or subscription-tier malware-scanning service is evidenced by the current source.
Can I rename a file to bypass the type restriction? No. The platform checks the actual content of the file, not just the filename or extension you provide. Renaming a file does not change its underlying type.
Who can delete uploaded files? Pending question uploads can be cancelled only through their owner-bound route. Replacing/removing current answer files uses the response-edit pipeline and deferred link-checked cleanup. Authorization depends on the specific route; there is no universal uploader-or-admin delete rule.