NorthStack applies deny-by-default access controls, private storage, signed URLs for sensitive documents, MFA, session timeouts and administrative-action logging in its authenticated portals (Phase 2). File uploads are restricted by type and size and scanned for malware.