Somewhere to put the files, that knows whose they are.
Finomium stores uploads on an S3-compatible bucket - SeaweedFS locally, a managed Space in production - scoped to the tenant that owns them, checksummed, and visible in an admin console that can tell you what is stored and how much room is left.
curl -X POST https://api.finomium.co/api/v1/files \
-H "Authorization: Bearer $TOKEN" \
-F "file=@contract-2026.pdf" \
-F "ownerType=account" -F "ownerUid=acme-isp"
# {"id":"8df4aec5-...","sizeBytes":1462184,"checksum":"sha256:9f2b...","contentType":"application/pdf"}S3-compatible, not S3-only
SeaweedFS in local development, DigitalOcean Spaces in production - nothing above the store adapter knows which. Switching is a change of endpoint and keys, not a rewrite.
Tenant-scoped by construction
Every object key carries the tenant it belongs to, so one customer's files are not reachable from another's session - the isolation is in the key, not in a filter somebody has to remember.
Checksummed and described
Each stored file records its own size, content type and checksum alongside the owner it belongs to - so an integrity check is a lookup rather than a download-and-compare.
An extension allowlist, not a MIME guess
Uploads are checked on the extension that ends up in the object key, because a caller can claim any Content-Type it likes. There is a per-upload size ceiling too, and the buffer limit sits above it so an over-size file gets an explanatory 400 rather than a bare stream error.
An admin view that answers real questions
Browse what is stored, see a per-tenant overview and summary, open or delete an individual file - a console for the person who has to answer "what is in there, and who put it there".
Capacity, where the store can report it
Against SeaweedFS the console reads the cluster's own volume budget and shows how much room is left. Capacity is not part of the S3 API, so on a managed Space that panel honestly reports unavailable instead of inventing a number.
Two callers, two doors
Other services authenticate with an internal API key; a person in the console authenticates with the same cmn-auth-svc token everything else here uses, behind its own role gate. Neither path can be used to walk through the other.
Degrades instead of hanging
A circuit breaker and a bulkhead sit around the object store, so a slow or dead bucket is refused quickly rather than tying up every thread waiting on it - one store having a bad day does not become the whole platform having one.
The attachment on a task is the attachment on an email
A document attached to a workflow task, an image on a campaign, a file a customer sent in - they are one store, one set of credentials and one place to look when somebody asks what is being kept. Adding a second product here does not mean adding a second bucket, a second key to rotate, or a second answer to "where did that file go".