Documents are one of the main ways into an AI platform. In Navin Enterprise AI, no file reaches document processing, OCR, media processing, transcription or RAG without being scanned first: scanning is a requirement, not a convention.
The path of a file
- Upload: the file is received.
- Quarantine: it stays isolated until the scan is complete.
- ClamAV and YARA-X: signature scanning and YARA rules.
- Validation: a scan authorization bound to the sha256 of the file is issued.
- Docling: document processing requires that authorization, as do OCR, media and transcription.
- RAG and AI: only validated content is indexed or sent to a model.
Built for banking requirements
Scanning is 100% local: no file leaves the platform to be scanned. It fails closed: a scanner that does not answer means the file is refused. Every verdict is audited, raises security events for the SOC when needed and feeds metrics, and the scanning services are deployed in high availability.
Hardened scanning services
clamd only listens on the local loopback and is only reached through an HTTPS gateway, because clamd exposed over TCP has neither TLS nor authentication and accepts the SHUTDOWN command. Signatures are updated by freshclam from the internal mirror. YARA-X runs as an HTTPS worker with the navin-baseline rules, updated by sha256 from the internal repository.
Archives need special care. Measurements on clamd 1.4.6 and 1.5.4 showed that a ZIP member larger than MaxFileSize comes back OK without being read in full, so the gateway and the platform read the central directory of the archive themselves.
The File security screen of the portal shows scans and their verdicts, and the four SDKs expose the file security methods.