Private originals
The live S3 workflow verifies checksum, size, encryption, and a pinned version. Conditional writes prevent silent replacement.
Evidence access should be deliberate.
Preserve the source recording, review the evidence, and explicitly decide what an authorized client may see.
Enter the workspaceProduct sign-in required for workspace accessControlled playback
Cloudflare Stream assets require private signed playback. Approval alone does not grant client access; release and client scope are checked separately.
Traceable decisions
The workspace records review, release, revocation, and access events. The application runtime cannot update or delete audit records.