# Event website file upload policy and acceptance worksheet

Event/site: __________  Policy owner: __________  Technical owner: __________  Review date: __________

| Upload flow | Purpose and uploader | Allowed types and size | Server-side validation and processing | Private intake / access | Editorial approver and publication destination | Retention / deletion owner |
|---|---|---|---|---|---|---|
| Speaker headshot | | | | | | |
| Sponsor logo | | | | | | |
| Attendee document | | | | | | |
| Staff media | | | | | | |

## Application controls to verify
- [ ] Every upload entry point and external provider is listed.
- [ ] Allowed extensions and limits are enforced by the server, not only the browser.
- [ ] Submitted Content-Type is not trusted as proof; file format/content checks suit the format.
- [ ] Stored names are generated; untrusted names cannot select a path or overwrite an existing file.
- [ ] Uploader permissions, processing limits and safe storage are enforced.
- [ ] Private intake files are not exposed through a public URL.
- [ ] Scanning or content transformation is assessed for relevant formats and risk.
- [ ] External scanning or processing of private files has an approved data-sharing route.

## Editorial and lifecycle controls to verify
- [ ] A reviewer checks intended event, permission to use, personal information and metadata.
- [ ] Only approved files move to the stated public destination.
- [ ] Rejected files remain private and have a deletion owner.
- [ ] Abuse, mistaken-publication and replacement requests have a response owner.

Safe sample evidence for allowed/rejected files and permissions: __________
Open issues / release decision / next review: __________

This worksheet records decisions. Implement and verify controls in the actual application and storage service; one validation check or a scanner result is not a security guarantee.