Access Controls

Learn about Access Controls in Couchdrop

Overview

Couchdrop provides multiple layers of access control to determine what users can access, which services they can use, and what actions they can perform.

Access is managed through a combination of role-based controls and more granular user, resource, and connection restrictions.

Role-Based Access Controls (RBAC)

Role-Based Access Control is used to manage access based on a user's assigned role or group membership.

In Couchdrop, this includes:

User Roles

User Roles define a user's broader level of administrative or operational access.

Roles separate users who manage the Couchdrop account from users who only require operational or external access.

For more information, see User Roles.

Groups

Groups let you apply common access settings to multiple users.

They can be used to assign shared roles, feature access, and other access settings consistently across a set of users.

For more information, see Groups.

Feature Access

Feature Access determines which Couchdrop services and features a user or group can use.

This includes controls for:

• SFTP and SCP
• FTP and FTPs
• Upload Portal
• Web Portal
• Shared Links
• Inboxes
• Transfer Automations and Actions
• Inbound AS2 Stations

Feature Access can be configured separately from a user's broader role.

For more information, see Feature Access.

Attribute and Resource-Based Access Controls

Couchdrop also provides more granular controls based on the user, the resource being accessed, and the connection context.

These controls can be used alongside roles and groups to further restrict access.

Root Directory

A user's Root Directory defines the highest level of the filesystem they can access.

Users cannot navigate above their assigned Root Directory and only see paths relative to that location.

For more information, see Root Directory.

Folder Permissions

Folder Permissions control what specific users and groups can do within individual folders.

Available permissions include:

• List Contents
• Get Properties
• Delete
• Upload
• Download
• Share
• Create Inbox
• Manage Permissions
• Manage Notifications

Folder Permissions use inheritance, allowing access to be applied broadly and overridden on specific folders where required.

For more information, see Folder Permissions.

Network ACLs

Network ACLs can restrict a user so they can only connect from approved IP addresses or networks.

This provides an additional connection-level restriction alongside user permissions.

For more information, see Firewalls and ACLs.

Expiry

User expiry controls how long a user account remains active.

A user can be configured to never expire or to expire after a specified period.

For more information, see Account Expiry.

How Access Controls work together

These controls can be combined to create a more specific access model.

For example, an external partner could be configured with:

• An External User role
• Membership in a partner Group
• SFTP and SCP Connections enabled
• /Customers/Partner-A as their Root Directory
• List Contents and Upload permissions on selected folders
• A Network ACL restricting connections to an approved network
• An Expiry date for temporary access

Each control addresses a different part of access:

Control	Purpose
User Roles	Defines broad administrative or operational access
Groups	Applies common access settings to multiple users
Feature Access	Controls which Couchdrop services can be used
Root Directory	Restricts filesystem visibility
Folder Permissions	Controls actions on specific folders
Network ACLs	Restricts where a user can connect from
Expiry	Restricts how long access remains available

Together, these controls let you manage both broad access and more granular restrictions without relying on a single permission model.