Requirements & Preflight ChecksLast updated: 6 August 2026

A few quick checks before installation will save time and avoid common setup issues.

• Confirm your secure storage approach — SFS Access is built to support secure file operations with above-webroot upload locations.
• Review Secure Root defaults — SFS Access will define a default Secure Root path when installed (which you can change) and can create upload locations within that path when required.
• Identify existing upload locations to retain — if you already have suitable above-webroot locations, they can be assigned to enclaves.
• Check path and permissions readiness — confirm your server can read and write the intended secure storage path.
• Decide if you want companion enhancements now or later — OTP, Vault, and Gateway are optional additions that extend baseline Access capabilities.
• Use a staging environment first — test installation and initial configuration in a staging environment before deploying to production. This lets you validate policy and membership settings without risk to live data.
• Back up your database and files — always take a full backup before adding new add-ons to an active site.

Before you start configuring enclaves and permissions, it helps to make some decisions in advance. This keeps your governance model intentional from the start.

• Which files need secure handling? Identify the files and workflows that should be protected.
• Where will those files be stored? To be securely managed, files should be in an enclave, which is a named secure file area linked to an above-webroot upload location. This may mean using an existing suitable location, or creating a new one and moving files into it.
• Who needs access? List the members and teams who will legitimately need to list, upload, download, or delete files in each protected area.
• What is the minimum access needed? The best security model is to give users the file permissions they need, without providing permissions they do not need.
• Who should manage policy? Decide which administrators will manage enclave settings and memberships. Keep this group as small as practical.
• What is your response plan? Decide in advance who can apply emergency enclave restrictions during an incident, and how affected users will be informed.

You do not need to have all of this decided perfectly before installation, but working through these questions before you create your first enclave will lead to better initial configuration.

SFS Access on its own provides the baseline feature set needed for secure file operations on an EE7 site.

This includes practical support for above-webroot storage locations and governed file operations using familiar EE file and tag workflows.

Baseline Access capabilities

• Create and maintain enclaves linked to qualifying upload locations.
• Create suitable upload locations within the Secure Root path when needed.
• Define and maintain eligibility pools (groups of members who are eligible to be assigned access within specific enclave scope).
• Assign and review enclave memberships and role permissions.
• Run Effective Access Check and review Security Activity Log.

Optional companion enhancements

You can enhance baseline Access by adding companions when your requirements expand.

• OTP Pro adds one-time passcode user verification for selected higher-security changes.
• SFS Vault adds encrypted-at-rest storage and stricter secure-root storage handling.
• SFS Gateway adds controlled sharing access for approved users outside the core team.

When to add companions

• Add OTP Pro when you want stronger validation for higher-security administrative changes.
• Add SFS Vault when encrypted-at-rest storage is required by your security or compliance policy.
• Add SFS Gateway when teams need safe, controlled sharing beyond internal enclave users.

1. Start with baseline Access and validate core secure file workflows.
2. Add OTP Pro, SFS Vault, or SFS Gateway according to your operational priorities.
3. Re-test affected operations after each companion is enabled.

Developer checklist

• Confirm baseline SFS Access behaviour before enabling companions.
• Confirm companion notices and operation visibility match expected dependencies.
• Confirm changes that require fresh OTP verification resume correctly after successful verification.