ADR 0007 — MinIO tenant-prefixed object storage with opaque keys

Status: Accepted · Date: 2026-07-23

Decision

Distributed MinIO with SSE-KMS encryption, versioning, and Object Lock (compliance mode) on the audit-exports and signed-documents buckets. Buckets: recordings, documents, renders, imports, quarantine, signed-documents, audit-exports. Object keys are org/{orgId}/clinic/{clinicId}/{resourceType}/{uuidv7} — UUIDs only, never patient identifiers or names. All access via core-api-issued pre-signed URLs (≤5 min expiry) or service credentials with per-bucket policies. Uploads land in quarantine until ClamAV scanning passes, then are server-side-copied to their destination bucket. Lifecycle rules expire quarantine (48h) and enforce retention classes configured per clinic.