Storage¶

Storage is where SchemAlign surfaces runtime files, logs, artifacts, and managed file-exchange areas used by integrations.

Storage has three distinct purposes:

Area	Purpose
Workspace	Runtime files and working data associated with pipelines and runs.
SFTP Spaces	Secure, organization-scoped file exchange with external systems over SFTP.
System Logs	Operational logs used for troubleshooting and support.

SFTP Spaces¶

SFTP Spaces provide a managed SFTP service hosted by SchemAlign. Use a Space when an external system needs to securely upload files to SchemAlign or retrieve files that SchemAlign makes available.

This is different from File Get and File Put connecting to an external SFTP server. With SFTP Spaces, the external system connects into the SchemAlign-managed SFTP service.

Each Space belongs to one organization and has a friendly alias. The standard structure is:

<space-alias>/
├── in/
└── out/

Use:

in/ for files arriving from external systems
out/ for files made available for external retrieval

SchemAlign does not automatically create an in/processed folder. Create additional folders only when your workflow needs them.

Customer-visible SFTP paths¶

When an external SFTP account connects, it lands in a restricted customer view:

/spaces

Only Spaces granted to that account are visible.

For example:

/spaces/hr-imports/in/employees.csv
/spaces/hr-imports/out/result.csv

Inside SchemAlign, pipelines use the canonical Space path without the /spaces prefix:

/hr-imports/in/employees.csv
/hr-imports/out/result.csv

The customer-visible and canonical paths reference the same underlying files.

Space access and permissions¶

SFTP resources are organization-scoped. A managed SFTP account can only be granted access to Spaces owned by the same organization.

Current grant modes are:

Permission	Behavior
Read only	The account can list and download permitted files but cannot modify them.
Read & modify	The account can read, upload, overwrite, rename, and delete files within the granted Space.

Permissions are enforced by the SFTP runtime and filesystem isolation, not only by the SchemAlign user interface.

Access is deny-by-default

An SFTP account sees only explicitly granted Spaces. Cross-organization Space grants are blocked.

Administration scope¶

By default, Org Admin can manage SFTP resources inside that organization. Application administrators can manage across organizations with ownership shown explicitly.

SFTP authorization checks organization scope and object ownership on the backend. UI visibility alone is not treated as authorization.

Managed SFTP accounts¶

Managed SFTP accounts are external SFTP identities, not SchemAlign application users.

SchemAlign's managed SFTP service uses:

SSH public-key authentication
SFTP-only sessions
no interactive shell
no command execution
no TCP, agent, or X11 forwarding
no TTY
no access to SchemAlign application secrets, the Docker socket, Workspace, System Logs, or the host filesystem

SchemAlign stores the account's public key. The corresponding private key remains with the external system or user and is never stored by SchemAlign.

See Use SchemAlign Managed SFTP for setup and connection guidance.

File Arrival automation¶

A File Arrival trigger can watch the in/ directory of an SFTP Space and start a pipeline after a direct file becomes stable.

Only direct files in in/ are eligible:

/hr-imports/in/file.csv              -> can trigger
/hr-imports/out/result.csv           -> does not trigger
/hr-imports/in/processed/file.csv    -> does not trigger
/hr-imports/in/subfolder/file.csv    -> does not trigger

File Arrival is detection-only. It does not automatically read, move, archive, or delete the file. The queued pipeline decides what happens next.

See Triggers.

Activity and auditing¶

SchemAlign records managed SFTP activity for operational review. Depending on the event, activity can include:

successful and failed authentication
session open and close
file upload/write
file download
file delete
file rename or move
administrative account, key, grant, and Space changes

Audit context includes organization, account, source IP, path, session, and key fingerprint where available. SchemAlign does not store private keys or file contents in the audit record.

How Storage relates to artifacts¶

An artifact is a physical or runtime output from a pipeline run. Storage is where users can inspect or manage those outputs when their access allows it.

SFTP Spaces are different: they are durable managed file-exchange locations that external SFTP clients can access when authorized.

Examples:

Storage item	Example
CSV artifact	`graduates_202640.csv` produced by a pipeline run
JSON response	API response captured during a run
Log file	Node or worker execution log
SFTP inbound file	`/hr-imports/in/employees.csv` uploaded by an external system
SFTP outbound file	`/hr-imports/out/result.csv` made available for retrieval

Operational guidance¶

Use Storage when you need to:

confirm that a file was generated
download or inspect a run output
manage organization SFTP Spaces and external SFTP access
review SFTP activity
verify that a File Arrival source file exists
review logs for a failed node
trace an integration issue from Overview into concrete files or artifacts

Storage is not a substitute for secrets management

Do not store passwords, tokens, private keys, or other secrets as ordinary files. Pipeline credentials belong in Accounts or approved secret-storage patterns. Managed SFTP authentication stores public keys only.