Validating upload link…
TLS 1.3 in transit
AES-256 via dedicated KMS key
Object Lock tamper-evidence
CloudTrail audit log
Token + password two-factor